CVE-2026-84167: Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user, including a user with the Subscriber role, can exploit it. The attacker does not need access to the targeted customer's account.
What information could be exposed?
An attacker can access other customers' booking details, including names, email addresses, phone numbers, and postal addresses.
What does an attacker need to do to access another customer's booking?
The attacker must be authenticated and reference a booking identifier that belongs to another user. The plugin does not verify ownership of the requested booking record.