CVE-2026-84166
Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
| Vendor | unknown |
| Product | hotel booking |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown hotel booking
Be the first to know when new unknown vulnerabilities affecting unknown hotel booking are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Hotel Booking
0 ≤ 3.8
References
Credits
Yaswanth Reddy Sunkara WPScan