The vulnerability identified as CVE-2026-27388 affects the DesignThemes Booking Manager plugin by designthemes. It is classified as a Missing Authorization issue, meaning that the plugin fails to properly enforce access control, allowing unauthorized users to perform actions that should be restricted. The affected versions include all versions up to 2.0. The CVSS 3.1 base score is 7.5, with the vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No patch or official remediation guidance is currently provided, and the product is not a cloud service.

The vulnerability allows unauthorized users to exploit access control weaknesses, potentially causing denial of service or disruption of availability in the affected Booking Manager plugin. There is no reported impact on confidentiality or integrity of data. No known exploits in the wild have been documented to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for updates from designthemes and apply any official patches once available. In the meantime, restricting access to the affected plugin or disabling it if feasible may reduce exposure.