The Booking for Appointments and Events Calendar plugin is vulnerable to an authorization bypass that enables authenticated attackers to hijack arbitrary WordPress user accounts.

This flaw, categorized as CWE-639, stems from a failure to perform adequate capability checks when modifying customer or employee records. An attacker with existing customer or employee management permissions can exploit this to change the email address and password of any other WordPress user.

Successful exploitation results in total account compromise, granting an attacker unauthorized access to sensitive administrative or user-level functions. Given the CVSS score of 7.2, the risk is high: an attacker can escalate privileges, access private data, or perform unauthorized administrative actions, leading to significant operational disruption and data loss.

Immediate Action: Update the Booking for Appointments and Events Calendar plugin to version 2.4.10 or later immediately to resolve the authorization logic error.

Proactive Monitoring: Review application logs for unusual administrative activity or unexpected changes to user account settings, particularly involving password or email modifications.

Compensating Controls: Implement a Web Application Firewall (WAF) to monitor for suspicious POST requests targeting user-profile or account-management endpoints within the plugin.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The severity of this vulnerability necessitates immediate action, as it provides a clear path for lateral movement and privilege escalation within the WordPress environment. Administrators should verify their current version of the plugin and apply the 2.4.10 patch without delay to prevent unauthorized account takeovers.