CVE-2026-84167
Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
| Vendor | unknown |
| Product | hotel booking |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown hotel booking
Be the first to know when new unknown vulnerabilities affecting unknown hotel booking are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Hotel Booking
0 ≤ 3.8
References
Credits
Yaswanth Reddy Sunkara WPScan