A missing authorization flaw in the VonStroheim TheBooking plugin allows unauthenticated attackers to bypass access controls, posing a significant risk to site integrity and data confidentiality.

This is a missing authorization vulnerability (CWE-862) that permits unauthenticated users to interact with administrative or restricted functions that lack proper capability checks.

The ability for an unauthenticated user to access constrained functionality can lead to unauthorized data modification, information disclosure, or disruption of business processes. With a CVSS score of 7.3, this vulnerability is classified as high severity, reflecting the ease of exploitation over a network without requiring user interaction or prior authentication.

Immediate Action: Review the vendor advisory for the release of a security patch and update the TheBooking plugin to the latest version immediately upon availability.

Proactive Monitoring: Monitor server access logs for anomalous requests to the plugin's endpoints and investigate any unauthorized attempts to perform administrative actions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin's API endpoints until a formal patch can be applied.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the high CVSS score and the lack of authentication required to trigger this flaw, organizations should treat this as a priority update. If a patched version is not yet available from the vendor, consider temporarily deactivating the plugin to prevent potential exploitation until a secure update is confirmed and deployed.