This vulnerability, classified as CWE-266 (Incorrect Privilege Assignment), affects Service Finder Booking versions up to and including 6.2. It allows users with subscriber privileges to escalate their access rights, potentially gaining higher privileges than intended. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, resulting in high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

Successful exploitation could lead to unauthorized privilege escalation from subscriber level to higher privilege levels, compromising the confidentiality, integrity, and availability of the affected system. This could allow attackers to perform unauthorized actions within the Service Finder Booking environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to privilege escalation attempts.