4.3
Moyenne
CVE-2026-84166 The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order…
Description
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Hotel Booking 3.8 | premières → 3.8 | Pas de correctif indiqué |