CVE-2026-9822 — WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers

CVE-2026-9822

WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers PUBLISHED

Description (CNA)

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Hotel Booking	affected 0 before 2.3.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/107fe41a-c5d9-4547-b413-bbd77cbab986/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.