WP Booking System EUVD-2026-48162

Exploitation requires an authenticated account at Subscriber level or above on the target site (CVSS PR:L), so the attacker must be able to register or already possess a low-privilege login - sites permitting open user registration satisfy this by default, while sites that disable self-registration and vet accounts substantially limit exploitation. The target must run WP Booking System at a version below 5.12.8.1 with the affected access-controlled action reachable. Limiting factors: a valid low-privilege session is mandatory (not fully unauthenticated), no user interaction from a victim is needed (UI:N), and impact is confined to integrity/availability of booking data (C:N), not disclosure of site secrets.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L describes network-reachable, low-complexity abuse requiring low privileges (an authenticated Subscriber) and no user interaction, with high integrity impact, low availability impact, and no confidentiality impact - consistent with a data-manipulation rather than data-disclosure flaw. Real-world risk is moderate and conditional: the PR:L requirement means an attacker first needs a valid low-level account, which is trivial on sites allowing open registration but a meaningful barrier on locked-down sites. No EPSS score, KEV entry, or public POC was provided, so there is no evidence of active or automated exploitation at this time; this reads as a genuine but not urgent priority - patch on a normal cycle, expedited for sites with open Subscriber registration. No SSVC decision data was supplied. Note the C:N/I:H rating: the flaw compromises integrity of booking data, not confidentiality, so it is not a data-breach vector per the vendor scoring.

An attacker registers a free Subscriber account on a WordPress site running a vulnerable WP Booking System version (or uses an existing low-privilege account), then sends a crafted request directly to a plugin endpoint that lacks a proper capability check. Leveraging AV:N/AC:L/PR:L, they invoke booking-management functionality reserved for higher roles - creating, altering, or deleting reservation data - to corrupt bookings or disrupt the reservation workflow. No public exploit code is currently identified, so exploitation would require an attacker to derive the request manually from the disclosed weakness.