EUVD-2026-37994
GHSA-mcv8-q72x-f535
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L required since a Subscriber-level account is mandatory; C:H reflects cross-user booking PII and coupon enumeration; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
AnalysisAI
Missing authorization controls in the WP Hotel Booking WordPress plugin (all versions before 2.3.1) expose sensitive hospitality business data to any authenticated Subscriber-level user. Affected AJAX handlers lack WordPress capability checks, enabling low-privilege users to read other guests' booking line items, enumerate active coupon codes, and access internal pricing data across the entire site. A public proof-of-concept exploit exists per WPScan; while not confirmed actively exploited in CISA KEV, the low authentication barrier and publicly available exploit represent meaningful real-world risk for any hotel or hospitality site with user registration enabled.
Technical ContextAI
WordPress plugins register server-side AJAX callbacks via the wp_ajax_ and wp_ajax_nopriv_ hook system. Properly secured handlers call current_user_can() or equivalent capability checks before processing requests. WP Hotel Booking before 2.3.1 omits these checks across several of its AJAX handlers, meaning any authenticated session - including the lowest default WordPress role, Subscriber - can invoke privileged data-retrieval operations directly by posting to wp-admin/admin-ajax.php with the appropriate action parameter. The affected product is identified by CPE cpe:2.3:a:unknown:wp_hotel_booking:*:*:*:*:*:*:*:*, covering all versions up to but not including 2.3.1. No formal CWE is assigned in the source data, but the root cause aligns with CWE-862 (Missing Authorization) and CWE-284 (Improper Access Control). The data exposed - booking line items, coupon codes, and pricing - is operationally sensitive for hotel operators and guests alike.
RemediationAI
Upgrade WP Hotel Booking to version 2.3.1 or later, which is the vendor-released patch resolving the missing capability checks across affected AJAX handlers; apply the update via the WordPress admin dashboard under Plugins > Installed Plugins. If immediate patching is not possible, restrict or disable public user registration (Settings > General > uncheck 'Anyone can register') to eliminate the Subscriber-account entry point - note this prevents new user self-registration site-wide. Alternatively, temporarily deactivating the WP Hotel Booking plugin eliminates exposure but also disables all booking functionality until the patch is applied. Site administrators should audit existing Subscriber accounts for any anomalous AJAX activity in server access logs targeting wp-admin/admin-ajax.php. The authoritative fix advisory is at https://wpscan.com/vulnerability/107fe41a-c5d9-4547-b413-bbd77cbab986/.
More in Wp Hotel Booking
View allThe WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/r
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not esca
SQL injection in the WP Hotel Booking WordPress plugin before 2.3.2 allows users holding plugin-specific booking-managem
Reflected Cross-Site Scripting in the WP Hotel Booking WordPress plugin (ThimPress) through version 2.3.2 enables unauth
The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensu
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in
Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion
Missing Authorization vulnerability in ThimPress WP Hotel Booking.0.9.2. Rated medium severity (CVSS 6.5), this vulnerab
Stored XSS in the WP Hotel Booking WordPress plugin (all versions through 2.3.2) allows authenticated contributors to in
Reflected cross-site scripting in the WP Hotel Booking WordPress plugin (all versions up to and including 2.3.1) permits
Payment bypass in WP Hotel Booking (WordPress plugin, all versions ≤2.3.1) allows unauthenticated attackers to mark arbi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today