medium4.3
CVE-2026-84166
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a…
Impact
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Affected products
| Product | Affected versions |
|---|---|
| Hotel Booking WordPress Plugin | through 3.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.