Description

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T06:17:00.300Z",
  "pubdate": "2026-10-12T06:17:00.300Z",
  "executiveSummary": "The Hotel Booking WordPress plugin, in all versions up to and including 3.8, contains a Cross-Site Request Forgery (CSRF) vulnerability within its administrative booking management functionality.\nThis vulnerability exists because the plugin fails to implement sufficient anti-CSRF tokens or state-changing request validation for sensitive operations.\nA remote, unauthenticated attacker can exploit this flaw by tricking a logged-in administrator into visiting a malicious website or clicking a crafted link.\nThe successful execution of this attack allows the unauthorized modification, deletion, or creation of booking order records within the administrative dashboard.\nThe impact is significant as it compromises the integrity of booking data and could be used for business logic manipulation or data exfiltration.\nThe exploitation requirement is that an administrator with an active session must be induced to perform an action on a third-party site while authenticated to the WordPress backend.\nThis risk is categorized as high, as it bypasses authorization checks by leveraging the administrator's existing session privileges.",
  "technicalDetails": "The root cause of this vulnerability is the absence of a unique, per-request, or per-session anti-CSRF token (e.g., WordPress 'nonce') in the administrative booking order management interface.\nBy omitting these security tokens, the plugin fails to verify that the request originated from the intended administrative dashboard rather than an external, malicious source.\nExploitation occurs when an attacker crafts a malicious request—typically via a hidden HTML form or a script—designed to interact with the plugin’s order management endpoints.\nWhen a logged-in administrator visits a site controlled by the attacker, the attacker's script executes a background request (HTTP GET or POST) to the vulnerable WordPress URL associated with booking actions.\nBecause the victim’s browser automatically includes the session cookies associated with the WordPress installation, the server processes the request as legitimate, assuming it was initiated by the administrator.\nThe vulnerable component includes the specific backend controllers responsible for processing booking order modifications, deletions, and creations.\nAn attacker can manipulate the parameters in the forged request to alter booking statuses, delete entries, or insert fraudulent booking records directly into the database.\nThe attack flow follows these steps: 1) The attacker determines the administrative endpoints for the Hotel Booking plugin. 2) The attacker creates a malicious page containing a forged request that mimics the admin-side operations. 3) The attacker lures a privileged user (administrator) to the malicious page. 4) The victim's browser sends the forged request to the WordPress site. 5) The server validates the session cookies, sees the user is an admin, and executes the malicious request, resulting in unauthorized data modification.\nPost-exploitation impact includes complete loss of booking integrity, the potential for financial disruption, and the ability to cause mass deletion of administrative records, which can severely impact business operations and reliability."
}