CVE-2026-9822: Unknown Wp Hotel Booking

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.

Affected products

• Unknown Wp Hotel Booking: before 2.3.1 (fixed in 2.3.1)

Published 2026-06-19. Last modified 2026-06-22.