CVE-2026-84167: Unknown Hotel Booking

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

Affected products

• Unknown Hotel Booking: up to and including 3.8

Published 2026-10-12. Last modified 2026-10-13.