Hotel Booking, CVE-2026-84167
- CVE, Research URL
- Home page URL
- Application
- Published on
- Oct 12, 2026
- Research Description
- The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
- Affected versions
-
max 3.8.
- Status
-
vulnerable