Hotel Booking Lite EUVD-2026-41346

Exploitation requires a valid WordPress subscriber-level (or higher) account on the target site running Hotel Booking Lite 6.0.3 or earlier. The CVSS vector PR:L confirms authenticated access is mandatory - unauthenticated exploitation is not supported by available data. Exploitation is further constrained to sites where the Hotel Booking Lite plugin is actively installed and enabled. No non-default configuration is specified as required. What limits exploitation: the attacker must possess or obtain a WordPress account on the target site, even at the lowest privilege tier; sites that disable public user registration reduce exposure to already-existing internal or staff accounts only.

The NVD CVSS score of 6.5 (Medium) is consistent with the risk profile: the attack is network-accessible with low complexity and requires only a subscriber-level WordPress account, but does not allow data modification or service disruption. The high confidentiality impact metric is the key driver of concern - guest PII, reservation details, or financial references exposed could constitute a GDPR or PCI-adjacent data breach event for affected operators. EPSS data is not present in the provided intelligence, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no public proof-of-concept reported, indicating this is not under active mass exploitation. Realistically, this vulnerability is most dangerous to hotel/hospitality WordPress deployments that permit open user registration or have multiple staff accounts at subscriber level, as any such account becomes a data exfiltration vector. The risk is moderate and real, not inflated - the CVSS score and underlying impact are coherent. The limiting factor is the PR:L requirement; unauthenticated exploitation is not indicated by the available data.

An attacker registers or already holds a subscriber-level account on a target hotel's WordPress site running Hotel Booking Lite 6.0.3 or earlier. The attacker sends a crafted authenticated HTTP request - likely to a REST API endpoint or AJAX handler - and receives a response containing sensitive booking records, guest personal data, or reservation details belonging to other users. No public proof-of-concept has been reported, but the low complexity CVSS rating suggests this is straightforward to reproduce once an authenticated session is obtained.