Vulnerability · Published Jun 19, 2026 · Assigned by WPScan
CVE-2026-9822WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers
Medium 6.5
In plain English
A medium-severity security flaw in WP Hotel Booking from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 72.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Hotel Booking | 0 – before 2.3.1 |
References
- https://wpscan.com/vulnerability/107fe41a-c5d9-4547-b413-bbd77cbab986/ exploit, vdb-entry, technical-description