Unrated severityNVD Advisory· Published Jan 22, 2025· Updated Apr 8, 2026
WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
CVE-2024-13447
Description
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a list of registered user emails.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<=2.1.6+ 1 more
- (no CPE)range: <=2.1.6
- (no CPE)range: 0
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.