This vulnerability in the wpdevart Booking calendar, Appointment Booking System plugin is due to missing authorization checks, which results in incorrect access control. It affects all versions up to and including 3.2.36. The issue allows an unauthenticated attacker to perform actions that should require authorization, leading to integrity impact without affecting confidentiality or availability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope.

The vulnerability allows unauthorized modification of data within the affected plugin, impacting data integrity. There is no impact on confidentiality or availability according to the CVSS vector. Exploitation does not require privileges or user interaction, increasing the risk of unauthorized changes to booking data or system settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to booking calendar modifications. Avoid exposing the booking system interface to untrusted networks if possible.