CVE-2026-84166 — Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF

CVE-2026-84166

Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF PUBLISHED

Description (CNA)

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

Affected (CNA)

Vendor / product	Versions
Unknown / Hotel Booking	affected 0 through 3.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b3193e98-4b40-4fba-995d-a3ed897f852c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.