CVE-2026-84167

Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

Affected

Hotel Booking

CVSS v3.1 CNA

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.17% chance of exploitation in the next 30 days, 5th percentile

Published

2026-10-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/77073fed-5f88-4fc5-82ea-7f588483961a/

References

• CVE Record
• NVD entry