Hotel Booking Lite < 6.0.4 – Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action | CVE 2026-15235

Description

The plugin does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.

Proof of Concept

Prerequisite: Hotel Booking Lite < 6.0.4 active, with at least one booking that has a customer. The attacker holds any logged-in account (Subscriber, or an auto-created mphb_customer account).

1. Log in as a Subscriber, load any front-end page, and read the admin-calendar booking-info nonce from the page source (the plugin localizes it into MPHB._data.nonces for every logged-in user).

2. Read any booking's customer PII by iterating booking_id:

curl -s -b cookies.txt -X POST 'https://victim.example/wp-admin/admin-ajax.php' \
  --data-urlencode 'action=mphb_get_admin_calendar_booking_info' \
  --data-urlencode 'mphb_nonce=<nonce from step 1>' \
  --data-urlencode 'booking_id=5'

3. The HTTP 200 JSON response contains booking #5's First/Last name, Email, Phone, Country, Address, City, State, Postcode, customer note, and payment table. Iterate booking_id to walk the entire customer base. (Control: the same request unauthenticated returns "0" — the action is logged-in-only.)