EUVD-2026-97243
GHSA-v5m6-vwfw-3352
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure authenticated admin to malicious page
-
ExploitBrowser auto-submits forged booking request
-
ExecutionPlugin processes request lacking CSRF token
-
ImpactBooking order records created/modified/deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a user with administrative privileges over the Hotel Booking plugin's booking order management be logged in AND be tricked into loading an attacker-controlled request (hidden form/auto-submit) in the same browser session - this user interaction (UI:R) is the primary limiting factor. The vulnerable functionality is the plugin's administrative booking order management (create/delete/modify order records) in versions through 3.8; no special non-default configuration is named in the advisory. The attacker needs no account of their own (PR:N), but cannot act without an authenticated admin victim, and impact is confined to booking order record integrity. |
| Impact | This is a moderate-risk, not high-priority, issue. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - the PR:N reflects that the attacker needs no account of their own, but exploitation is fundamentally gated by UI:R: a logged-in administrator must be lured into visiting an attacker-controlled page while authenticated. The impact is limited (C:N/I:L/A:N) - only integrity of booking order records, no confidentiality or availability loss and no scope change. No EPSS score, KEV listing, or POC flag was provided in the input, so there is no signal of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The signals are internally consistent (network-delivered forged request requiring victim interaction matches a classic CSRF), so no metric conflicts need flagging. Overall: a legitimate but low-urgency flaw whose real-world risk is capped by the social-engineering requirement and the limited integrity-only impact. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page or email containing a hidden auto-submitting form targeting the plugin's admin booking-order endpoint. A logged-in Hotel Booking administrator who visits the page while authenticated unknowingly issues a forged request that creates, deletes, or alters booking order records. No public exploit code was identified in the provided data, though the technique is trivial to reproduce from the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Cross-site request forgery in the Hotel Booking WordPress plugin (versions through 3.8) lets an attacker forge administrative requests that create, delete, or modify booking order records inside an administrator's authenticated browser session, yielding a limited integrity-only impact (CVSS 4.3, C:N/I:L/A:N). The attacker needs no account of their own (PR:N), but the attack only succeeds if a logged-in administrator is tricked into loading an attacker-controlled page or hidden auto-submitting form (UI:R), which is the primary limiting factor. No public exploit code has been identified at time of analysis, and confidentiality and availability are not affected - only the accuracy of booking order data is at risk.
RemediationAI
No vendor-released patched version is identified in the available data, so the first action is to determine whether a fix has been published since the advisory: check the WPScan advisory at https://wpscan.com/vulnerability/b3193e98-4b40-4fba-995d-a3ed897f852c/ and the plugin's WordPress.org page/repository for a release newer than 3.8, and upgrade immediately if one exists. If no fix is available - particularly if the plugin is abandoned or closed - the most reliable mitigation is to deactivate and remove the plugin and migrate to a maintained booking solution, accepting the operational cost of data migration and possible loss of existing bookings. If the plugin must remain temporarily, restrict the booking order management screens to a minimal set of trusted administrators, instruct those administrators to use a dedicated browser profile and to avoid browsing untrusted sites or clicking unsolicited links while logged in, and deploy a WAF or reverse-proxy rule that rejects cross-origin state-changing requests to the plugin's order-management endpoints, ideally by validating the WordPress nonce or comparing Origin/Referer with the site host; note that overly strict origin or nonce checks can break legitimate admin actions and must be tested in staging first. Enforcing SameSite=Strict on WordPress authentication cookies adds defense in depth but can disrupt legitimate cross-site and single-sign-on flows, and reviewing booking order records for unexpected creation, modification, or deletion provides a compensating detection control given the integrity-only nature of the impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CSRF weakness (CWE-352) in a WordPress plugin's administrative booking order management functionality. State-changing operations for creating, deleting, and modifying booking orders are reachable through the WordPress admin interface but, per the advisory, are not protected by WordPress nonce verification (for example wp_nonce_field()/check_admin_referer()) or equivalent anti-CSRF tokens. Because browsers automatically attach the administrator's WordPress authentication cookies to requests originating from any site, an attacker who can lure an admin into visiting a crafted page can silently cause the admin's browser to submit those order-management requests. CWE-352 root cause: the application fails to verify that a request originated from its own UI and was intentionally issued by the authenticated user. The supplied CPE data is absent from the feeds, but EUVD records the affected range as Hotel Booking 0 through 3.8, and the vulnerability is reported by WPScan, whose advisory at https://wpscan.com/vulnerability/b3193e98-4b40-4fba-995d-a3ed897f852c/ is the only technical reference provided alongside the NVD entry. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network reachability and no attacker privileges, with the user-interaction requirement and unchanged scope reflecting that impact stays within the plugin's booking-order data.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CSRF delivered over the network (AV:N) with no attacker auth (PR:N) but mandatory admin victim interaction (UI:R); integrity-only impact on booking records (I:L), no confidentiality or availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB