CVE-2026-118084: WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
Published Oct 29, 2026
·Updated
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
Event History
Oct 29, 2026
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated user with Subscriber-level access can exploit the IDOR vulnerability. The vector is network-accessible and does not require user interaction.
2
What is the potential impact?
The vulnerability can expose confidential information. The supplied vector indicates no integrity or availability impact.
3
Which plugin versions are affected?
Hotel Booking versions up to and including 3.8 are identified as affected.