Hotel Booking CVE-2026-84167

Requires an authenticated WordPress account of any privilege level (Subscriber suffices, per PR:L); the attacker must reference a booking identifier belonging to another customer, which is feasible because the plugin performs no ownership check on booking records. The practical enabling condition is that the target site permits user self-registration (common on booking/hospitality sites), lowering the authentication barrier to near-zero. Limiting factors: an account is still required (not fully anonymous), impact is read-only disclosure of booking PII with no integrity or availability effect, and the issue affects Hotel Booking versions through 3.8 only.

This is a genuine but moderate-priority authorization flaw (CWE-639, IDOR), not a high-severity emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3 Medium) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input, so there is no evidence of active exploitation or public exploit code. The main risk driver is that WordPress booking sites frequently allow open self-registration, which makes the PR:L barrier trivial to satisfy in practice, turning this into a near-anonymous PII harvesting primitive against guest names, emails, phone numbers and postal addresses. Against that, impact is read-only exposure of booking PII - no account takeover, data modification, or system compromise - so this is a privacy/data-protection concern (potential GDPR exposure given ENISA EUVD tracking) rather than a server-compromise one. Signals are not conflicting; they consistently point to a real-but-contained issue. Note the 'Authentication Bypass' tag is imprecise - the user is authenticated and bypasses authorization (object-level access control), not authentication.

An attacker registers a free Subscriber account on a hotel's WordPress site running Hotel Booking ≤3.8 (or uses any existing low-privilege login), then requests booking records while supplying booking identifiers they do not own. Because the plugin never checks that a booking belongs to the requester, it returns other guests' names, emails, phone numbers and postal addresses, which the attacker enumerates to harvest customer PII at scale. No public exploit code was identified in the provided data, but the attack requires only trivial identifier manipulation and no special tooling.