CVE-2023-5651

PoC —

CVSS 3.1

5.4 medium

EPSS

<1%p20

Published

Nov 20, 2023 (Nov 20, 2023)

Modified

Jun 17, 2026

Description

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts

Vendors: thimpress
Products: wp hotel booking
Ecosystems: WordPress
Weakness: CWE-732
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.