WP Hotel Booking CVE-2026-9822

Exploitation requires a valid authenticated WordPress session at Subscriber privilege level or higher on the specific target site - the lowest default role assigned to any registered user. The vulnerable code paths are the AJAX handlers registered by the WP Hotel Booking plugin that omit current_user_can() checks; the plugin must be installed and active on the target site running a version below 2.3.1. Unauthenticated exploitation is not possible per the CVSS PR:L rating. Sites with user registration disabled (no open self-registration) face materially reduced risk, as an attacker must first acquire or create an account through another means. The attack is not automatable at scale (SSVC: Automatable: no) because a distinct authenticated account is required per target site. Impact is bounded to confidentiality only - no write or destructive capability is exposed by these handlers.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) is internally consistent with the vulnerability description: network-reachable, low complexity, requires only a low-privilege account, no user interaction, and yields high confidentiality impact with no integrity or availability dimension. The SSVC assessment reinforces this picture - exploitation is rated poc (public exploit confirmed, not yet active mass exploitation), attack is not automatable (requires a per-site authenticated account), and technical impact is partial. No EPSS score was provided, so exploitation probability cannot be quantified from this dataset. The absence of a CISA KEV listing means confirmed active exploitation at scale has not been established; however, the combination of a public PoC reported by WPScan and a minimal authentication barrier (any registered user) means the practical risk for unpatched sites with open registration is elevated above what the mid-range CVSS score alone might suggest. The non-automatable SSVC rating correctly limits mass scanning risk, but targeted abuse of specific hotel sites - particularly coupon code enumeration for financial fraud - is a plausible near-term threat.

An attacker registers a free Subscriber account on a hotel's WordPress site running an unpatched WP Hotel Booking version, then uses the publicly available WPScan proof-of-concept to directly invoke unprotected AJAX endpoints, iterating over booking records to harvest guest personal data and extract active coupon codes. The attacker can then apply stolen coupon codes to their own bookings for unauthorized discounts or sell the extracted guest PII and coupon data externally.