This vulnerability in the WP Time Slots Booking Form plugin arises from missing authorization checks, which means that certain actions or data may be accessible without proper permission validation. The issue affects versions up to 1.2.42. The CVSS score is 5.3 (medium), with an attack vector of network, no privileges required, no user interaction needed, and impact limited to integrity. There is no vendor advisory or patch information provided, and the plugin is not a cloud service, so remediation depends on vendor updates or user mitigation.

The vulnerability allows unauthorized users to perform actions or access functionality that should be restricted, potentially leading to unauthorized modification of data (integrity impact). There is no impact on confidentiality or availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor for updates from codepeople and consider restricting access to the plugin's functionality via other means, such as web application firewalls or access control rules. Avoid exposing the plugin to untrusted users where possible.