WP Hotel Booking, 6a028b01-38e4-4c12-aa19-9a83cf6c1b41

CVE, Research URL: 6a028b01-38e4-4c12-aa19-9a83cf6c1b41
Home page URL: Security reports for WP Hotel Booking
Application: WP Hotel Booking
Published on: -
Research Description: WP Hotel Booking [wp-hotel-booking] < 2.0.9.3 WP Hotel Booking < 2.0.9.3 - Improper Authorization on Multiple REST API Routes The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to an improper capability check on the 'pricing_plans', 'block_date', 'manager_bookings', and 'update_field_room' functions for the 'pricing-plans', 'block-date', 'manager-bookings', and 'update-field' REST routes, respectively, in versions up to, and including, 2.0.9.2. This makes it possible for unauthenticated attackers to expose sensitive information about bookings or modify them.
Affected versions: max 2.0.9.3.
Status: vulnerable