CVE-2026-84166
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Risk Assessment
The risk includes the possibility of unauthorized modification of booking data by an attacker, which could lead to business disruption, data loss, or fraud. Administrators can be tricked into performing harmful actions.
Recommendation
It is recommended to update the Hotel Booking plugin to the latest patched version. Also implement CSRF tokens in all administrative forms.
Other vulnerabilities in Hotel Booking WordPress plugin
Original NVD description (English source)
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS