CVE-2023-5651
WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion
MEDIUM 5.4EPSS 0.3%
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts
- Affected
- WP Hotel Booking
- CVSS v3.1 NVD
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - EPSS
- 0.27% chance of exploitation in the next 30 days, 18th percentile
- Published
- 2023-11-20
- Updated
- 2024-10-01