The Booking X plugin for WordPress is subject to an unauthenticated data exposure vulnerability that could lead to the theft of user accounts and payment credentials.

This vulnerability is caused by a missing authorization check (CWE-862) within the export_now() function. An unauthenticated attacker can exploit this flaw by sending a crafted POST request to the plugin, resulting in unauthorized access to sensitive information including user meta and PayPal credentials.

The exposure of user accounts and financial credentials poses a severe risk to organizational data integrity and customer trust. Given the CVSS score of 7.5, this high severity vulnerability could lead to widespread account takeover, financial fraud, and significant regulatory non-compliance regarding the protection of sensitive user data.

Immediate Action: Since a specific patched version is currently unknown, administrators should immediately deactivate and remove the Booking X plugin from their WordPress environment until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous POST requests directed at the plugin directory, specifically looking for traffic patterns targeting export or administrative functions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access attempts to the vulnerable plugin endpoints until the software is updated or removed.

Public Exploit Available: No.

Due to the sensitive nature of the data exposed, including PayPal credentials and user meta, this vulnerability presents an urgent risk to WordPress site operators. Organizations must prioritize the removal of the vulnerable plugin to prevent unauthorized data exfiltration until the vendor provides a verified security patch.