Vulnerability · Published Oct 12, 2026 · Assigned by WPScan
CVE-2026-84166Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF
Medium 4.3
In plain English
A medium-severity cross-site request forgery in Hotel Booking from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.1%top 99.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Hotel Booking | 0 – through 3.8 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/b3193e98-4b40-4fba-995d-a3ed897f852c/ exploit, vdb-entry, technical-description