CVE-2026-84166
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-352
Impact
Attackers can create, modify, or delete booking records by tricking an authenticated administrator into clicking a malicious link. This requires user interaction from a logged-in admin.
Root cause
The plugin lacks CSRF token validation on administrative booking order management endpoints.
Affected systems
Hotel Booking WordPress plugin through 3.8
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade to a version past 3.8 once released, or deactivate the Hotel Booking plugin until a patch is available.
$ wp plugin deactivate hotel-bookingAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.