Description

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T06:17:00.420Z",
  "pubdate": "2026-10-12T06:17:00.420Z",
  "executiveSummary": "The Hotel Booking WordPress plugin through version 3.8 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.\nThis flaw exists due to insufficient server-side authorization checks when handling booking record requests.\nThe vulnerability allows any authenticated user, such as a Subscriber, to bypass access controls and retrieve sensitive PII belonging to other customers.\nCompromised data includes full names, email addresses, phone numbers, and postal addresses.\nThe risk is categorized as high due to the exposure of sensitive customer data and the ease of exploitation, which requires only basic authentication within the WordPress environment.\nAttackers do not require administrative privileges to perform this data exfiltration, relying solely on manipulating input identifiers in requests to access unauthorized booking records.",
  "technicalDetails": "The vulnerability is rooted in an Insecure Direct Object Reference (IDOR) within the plugin's data retrieval logic. The plugin fails to perform adequate access control checks to verify that the requesting user is the legitimate owner of the requested booking record identifier.\nWhen a user submits a request to view a booking, the application processes a parameter—typically an ID or slug—to fetch the associated record from the database. Because the underlying code lacks a conditional check (such as matching the 'user_id' field of the booking record against the 'ID' of the current authenticated session), the application treats the request as legitimate regardless of ownership.\nThe attack flow proceeds as follows: First, an authenticated attacker with low-level privileges (e.g., Subscriber) logs into the WordPress site. Second, the attacker identifies the request mechanism used by the plugin to view booking details. Third, the attacker systematically increments or guesses numeric identifiers or UUIDs associated with booking records. Finally, the server processes these unauthorized requests and returns the PII of the target booking to the attacker's browser.\nThis behavior exposes the plugin's internal database structure to unprivileged users, effectively allowing for mass scraping of customer records. Because the application processes these requests via standard authenticated sessions, the activity often evades basic rate-limiting or security monitoring tools if not explicitly configured to detect IDOR-style patterns.\nThe vulnerability affects all versions of the Hotel Booking plugin up to and including 3.8. The impact is significant as it facilitates large-scale PII harvesting, which violates GDPR, CCPA, and other data privacy regulations. The flaw is not related to remote code execution or SQL injection, but rather a fundamental failure in implementing secure object-level authorization (formerly mapped to CWE-285 or CWE-639)."
}