CVE-2026-118084

MediumCVSS 6.5

Published: 29/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

The Hotel Booking plugin in versions up to 3.8 contains an Insecure Direct Object References (IDOR) vulnerability in the subscriber area. This allows unauthorized access to resources identified by object references.

Risk Assessment

An attacker may access data or functions belonging to other users, potentially compromising the confidentiality and integrity of booking data.

Recommendation

Update the Hotel Booking plugin to a version later than 3.8. Verify that access control for subscriber resources is properly enforced server-side.

Other vulnerabilities in Hotel Booking

CVE-2026-39784High
The Hotel Booking plugin in versions up to 3.8 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

Original NVD description (English source)

Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS