Description (CNA)
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Hotel Booking | affected 0 through 3.8 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.