This vulnerability, identified as CWE-862 (Missing Authorization), exists in the Online Booking & Scheduling Calendar plugin for WordPress by vcita versions up to 4.6.0. It allows unauthenticated attackers to bypass access controls, potentially modifying data or performing unauthorized actions. The CVSS v3.1 base score is 7.5, reflecting a high severity due to the ease of exploitation (network vector, no privileges or user interaction required) and the impact on integrity. There is no indication of a vendor patch or advisory available at this time.

The vulnerability allows unauthenticated attackers to bypass authorization controls, leading to unauthorized modification of data (integrity impact). There is no impact on confidentiality or availability according to the CVSS vector. This could compromise the integrity of booking or scheduling data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's functionality where possible and monitor for suspicious activity related to booking or scheduling modifications.