This vulnerability (CVE-2026-57367) affects WP Booking System versions before 5.12.8.1 and is categorized as a missing authorization issue (CWE-862). It allows users with subscriber-level privileges to bypass access controls, potentially leading to unauthorized modification or disruption of system integrity. The CVSS v3.1 base score is 7.1, reflecting high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. No vendor advisory or patch information is available to confirm remediation status.

Exploitation of this vulnerability could allow a subscriber-level user to perform unauthorized actions that impact the integrity of the WP Booking System, potentially modifying data or system behavior beyond their intended permissions. There is no confidentiality impact, but integrity is highly affected, and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual activity related to booking system modifications.