The WP Time Slots Booking Form plugin by codepeople suffers from a missing authorization vulnerability in versions up to 1.2.42. This flaw allows attackers to bypass access control mechanisms due to incorrectly configured security levels, potentially enabling unauthorized modification of data or actions within the plugin. The CVSS v3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and an impact limited to integrity.

The vulnerability can be exploited remotely without authentication or user interaction, potentially allowing unauthorized users to perform actions that affect data integrity within the plugin. There is no impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the plugin's functionalities or applying compensating controls to limit exposure.