CVE-2026-84167
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-639
Impact
Authenticated users, including low-privilege Subscribers, can read other customers' personal booking details such as names, emails, phone numbers, and addresses. They only need standard account credentials to query booking IDs they do not own.
Root cause
The plugin lacks an authorization check (IDOR) to verify that a requested booking record belongs to the user querying it.
Affected systems
Hotel Booking WordPress plugin through 3.8
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade to a version newer than 3.8 if available, or deactivate the Hotel Booking plugin until a patched release is published.
$ wp plugin deactivate hotel-bookingAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.