The CVSS 8.1 on this Travelfic vulnerability deserves scrutiny before you treat it as a routine plugin patch. The score is technically accurate—broken access control at the subscriber level is serious—but the EPSS of 0.00352 tells a different story: mass exploitation is unlikely in the default WordPress configuration where subscriber registration is typically disabled. That gap between severity and exploitability is the first thing to understand, but it's not the full picture.
The more important question is what a subscriber can actually access inside Travelfic's booking context. Travelfic serves tour operators, hospitality providers, and travel agencies—businesses that handle passports, payment data, and booking integrations. A subscriber-level account in this context isn't just a user profile; it's an authenticated presence inside a system that already holds elevated trust with payment processors, reservation systems, and external travel APIs. The CVSS measures the access control failure but doesn't model the secondary trust that other systems extend to the plugin's sessions. That's where consequence can outpace the severity metric.
Your severity assessment should depend on one concrete fact: is subscriber registration enabled on your instance? If it's disabled and you can guarantee it stays disabled, the practical risk does decrease—though note that configuration assumptions have a way of changing through plugin updates, theme changes, or site migrations. If subscriber registration is active, treat this as a higher-priority patch because you've opened the exact registration pathway this vulnerability needs to become exploitable.
The version constraint "<=1.5.1" matters for a different reason: abandoned plugins don't get deleted, they get forgotten. If Travelfic development has stalled on your installation, that CVSS 8.1 becomes a persistent entry point into a system where security hygiene may have degraded silently as credentials expired and API integrations rotted. Prioritize confirming active maintenance or planning alternative solutions.
The EPSS number likely reflects the general WordPress ecosystem baseline, not the adjusted probability for travel-adjacent deployments where subscriber registration is often core functionality rather than an edge case. Apply that metric with context, not as a blanket reassurance.