medium6.5
CVE-2026-9822
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscr…
Impact
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
Affected products
| Product | Affected versions |
|---|---|
| WP Hotel Booking WordPress Plugin | before 2.3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.