Skip to content
Sign in
4.3 Medium

CVE-2026-84166 The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order…

Description

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

Affected products and versions

Product Affected versions Fixed in
Hotel Booking 3.8 earliest → 3.8 No fix stated

Other CVEs of Hotel Booking

The 2 CVEs of Hotel Booking →
CVE-2026-84167 The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting… 4.3 Medium
Track this CVE