WordPress Plugin Vulnerabilities

AweBooking <= 3.2.26 - Authenticated (Subscriber+) Information Exposure

Description

The AweBooking – Hotel Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.26. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
awebooking
No known fix

References

CVE
CVE-2025-68014
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7504e5-26a2-4387-8b79-43d6cf6fd0dc

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
NumeX
Verified
No
WPVDB ID
f0351e53-6601-4b04-96f8-b25d2e37a5e1

Timeline

Publicly Published
2025-12-30 (about 7 months ago)
Added
2026-01-14 (about 7 months ago)
Last Updated
2026-01-14 (about 7 months ago)

Other

Published
Title
Published
2024-03-19
Title
Easy Maintenance Mode <= 1.4.2 - Information Exposure
Published
2025-09-22
Title
WP System Information <= 1.5 - Authenticated (Subscriber+) Sensitive Information Exposure
Published
2026-06-25
Title
Print Invoice & Delivery Notes for WooCommerce < 7.1.2 - Unauthenticated Information Exposure
Published
2024-12-26
Title
Barcode Generator for WooCommerce – Show barcodes on products, orders, invoices and other pages < 2.0.3 - Authenticated (Subscriber+) Sensitive Information Disclosure
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure