An incorrect privilege assignment vulnerability in the LiquidThemes Booking Hub plugin allows authenticated users to perform unauthorized privilege escalation, posing a significant risk to system security.

The plugin contains an incorrect privilege assignment vulnerability (CWE-266) that permits an authenticated user to manipulate access controls. By exploiting this flaw, a low-privileged user can elevate their account permissions to administrative levels.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized administrative control over the Booking Hub plugin. With elevated privileges, an attacker could potentially modify booking data, access sensitive user information, or conduct further malicious activities within the WordPress environment, resulting in a full compromise of the plugin's data integrity and confidentiality. The CVSS score of 8.8 reflects the high severity of this potential unauthorized access.

Immediate Action: Since a specific patch version is not currently listed, administrators should monitor the official Patchstack security database or the WordPress plugin repository for the release of version 1.3.2 or higher.

Proactive Monitoring: Review WordPress user account logs for suspicious activity or unexpected changes to user roles and capabilities.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block suspicious requests targeting plugin-specific endpoints. If the plugin is not mission-critical, consider deactivating it until a vendor-supplied patch is verified and applied.

Public Exploit Available: Unknown.

Given the high CVSS score of 8.8, this vulnerability presents a severe risk to organizational security. Administrators are urged to prioritize the tracking of vendor updates and apply the necessary security patch immediately upon release to prevent potential unauthorized privilege escalation.