Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

Description

The plugin does not verify that a request to modify a user's plugin-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the plugin's per-user settings on arbitrary users, including administrators.