The vulnerability identified as CVE-2026-27405 in Magepeople inc.'s WpBookingly plugin is classified under CWE-862 (Missing Authorization). It affects versions up to 1.2.9 and allows exploitation due to improperly configured access control, potentially enabling users with certain privileges to carry out unauthorized operations. The CVSS v3.1 base score is 6.5, with the vector indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

The vulnerability can lead to unauthorized modification or disruption of the affected system's integrity and availability by users who have high privileges but should not be authorized for certain actions. There is no confidentiality impact reported. No known exploits have been observed in the wild, so the immediate risk appears limited but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor Magepeople inc.'s advisories for updates. Until a patch is available, carefully review and restrict user privileges to minimize potential exploitation.