CVE-2026-9822

—

CVSS 3.1

6.5 medium

EPSS

<1%p27

Published

Jun 19, 2026 (Jun 19, 2026)

Modified

Jun 22, 2026

Description

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.

Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.