WordPress Plugin Vulnerabilities

Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR

Description

The plugin does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

Proof of Concept

Affects Plugins

Plugin icon
nd-booking
No known fix

References

CVE
CVE-2026-84167

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Yaswanth Reddy Sunkara
Submitter
Yaswanth Reddy Sunkara
Verified
Yes
WPVDB ID
77073fed-5f88-4fc5-82ea-7f588483961a

Timeline

Publicly Published
2026-10-09 (about 2 days ago)
Added
2026-10-02 (about 9 days ago)
Last Updated
2026-10-02 (about 9 days ago)

Other

Published
Title
Published
2026-10-06
Title
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR
Published
2025-11-24
Title
Admin and Customer Messages After Order for WooCommerce: OrderConvo < 15 - Missing Authorization to Unauthenticated Information Disclosure
Published
2023-05-12
Title
RegistrationMagic < 5.2.1.0 - Admin+ Arbitrary Password Update via IDOR
Published
2024-01-26
Title
wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR
Published
2026-05-04
Title
GenerateBlocks < 2.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements