Unrated severityNVD Advisory· Published Jun 19, 2026
WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers
CVE-2026-9822
Description
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<2.3.1+ 1 more
- (no CPE)range: <2.3.1
- (no CPE)range: <2.3.1
Patches
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- wpscan.com/vulnerability/107fe41a-c5d9-4547-b413-bbd77cbab986/mitreexploitvdb-entrytechnical-description
News mentions
1- 25 WordPress Plugin CVEs Drop in Two Days: Critical File Deletion, SSRF, and XSS Lead the BatchVypr Intelligence · Jun 19, 2026