CVE-2026-84166: Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF
Published Oct 12, 2026
·Updated
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Affected Software
1 affected component
Hotel Booking<=3.8
Event History
Oct 12, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Who can be targeted by this issue?
A logged-in WordPress administrator who can access Hotel Booking administrative booking order management can be targeted. The attacker must be able to induce that administrator to submit a forged request.
2
What actions could a successful attack perform?
A forged request can create, delete, or modify booking order records. The affected administrative functionality does not implement CSRF protection.
3
Which releases are affected?
Hotel Booking versions through 3.8 are affected.