This vulnerability, identified as CWE-862 (Missing Authorization), affects QuickCal - Appointment Booking Calendar for WordPress versions up to 1.0.16. It allows improper access control in the booking agent component, potentially enabling users with certain privileges to perform unauthorized actions. The CVSS 3.1 score is 6.7, indicating a medium severity with high impact on confidentiality and availability, and low impact on integrity. No known exploits are reported in the wild, and no official remediation or patch has been published as of the data provided.

The vulnerability can lead to unauthorized access or manipulation of booking agent functionalities, resulting in high confidentiality impact and high availability impact, with some integrity impact. This could disrupt appointment booking processes or expose sensitive booking information to unauthorized users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor vendor communications for updates. Until a patch is available, restrict access to users with high privileges and review booking agent permissions carefully to minimize risk.