WP Hotel Booking, d2294ca814d99d510f98298381e62d5bbd8d39f8

CVE, Research URL: d2294ca814d99d510f98298381e62d5bbd8d39f8
Home page URL: Security reports for WP Hotel Booking
Application: WP Hotel Booking
Published on: Oct 20, 2023
Research Description: WP Hotel Booking [wp-hotel-booking] < 2.0.8 WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tp_extra_package_remove() function hooked via AJAX in all versions up to, and including, 2.0.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
Affected versions: max 2.0.8.
Status: vulnerable