WP Hotel Booking, d15f47f8730de77efe1ed67af61b35517347b26c

CVE, Research URL: d15f47f8730de77efe1ed67af61b35517347b26c
Home page URL: Security reports for WP Hotel Booking
Application: WP Hotel Booking
Published on: Feb 03, 2024
Research Description: WP Hotel Booking [wp-hotel-booking] < 2.0.9.3 WP Hotel Booking <= 2.0.9.2 - Improper Authorization on Multiple REST API Routes The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to an improper capability check on the 'pricing_plans', 'block_date', 'manager_bookings', and 'update_field_room' functions for the 'pricing-plans', 'block-date', 'manager-bookings', and 'update-field' REST routes, respectively, in versions up to, and including, 2.0.9.2. This makes it possible for unauthenticated attackers to expose sensitive information about bookings or modify them.
Affected versions: max 2.0.9.3.
Status: vulnerable