CVE-2023-5799: Thimpress Wp Hotel Booking

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them

Affected products

• Thimpress Wp Hotel Booking: before 2.0.8 (fixed in 2.0.8)

Published 2023-11-20. Last modified 2026-06-17.