CVE-2026-84167
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
Risk Assessment
The risk involves customer privacy breach and leakage of personal data, which could lead to legal consequences and loss of trust. Authenticated users with low privileges can access sensitive information.
Recommendation
It is recommended to immediately update the Hotel Booking plugin to the latest patched version. Also implement access controls so users can only read their own bookings.
Other vulnerabilities in Hotel Booking WordPress plugin
Original NVD description (English source)
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS