Security Alert Summary
The Hotel Booking WordPress plugin through version 3.8 lacks CSRF protection on its administrative booking order management. An attacker can craft a forged request that, if an administrator executes it while logged in, can create, delete, or modify booking order records in the administrative interface.
CVE Details
- CVE ID:
CVE-2026-84166 - Affected component: Hotel Booking WordPress plugin – administrative booking order management
- Affected versions: Versions through 3.8 (inclusive)
- Published: October 12, 2026 at 06:17:00 AM UTC
- Last modified: October 12, 2026 at 12:17:15 PM UTC
- CVSS v3.1: Base Score 4.3 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Attack details (from CVSS):
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- User Interaction: REQUIRED
- Scope: UNCHANGED
- Impact (C/I/A): Confidentiality: NONE; Integrity: LOW; Availability: NONE
- Weakness: CWE-352 (Cross-Site Request Forgery)
Technical Details
The plugin does not implement Cross-Site Request Forgery (CSRF) protections on its administrative booking order management functionality. Because CSRF protections are missing, an attacker can create a specially crafted request that causes a logged-in administrator to perform actions they did not intend, such as creating, deleting, or modifying booking order records.
The vulnerability is rooted in the absence of verification for the origin or intent of state-changing requests in the administrative booking order workflows. No specific functions or endpoints are named in the provided data; the description refers generally to administrative booking order management actions.
Impact is limited to integrity of booking data: an attacker able to convince an administrator to load a malicious link or visit a page can cause unwanted changes to booking orders. The vulnerability does not indicate direct disclosure of confidential data or availability impact.
How This Could Impact Your Website
In a realistic scenario, a site owner or internal staff member (for example, someone with administrative access who manages bookings) could be targeted by a social engineering message that convinces them to open a web page or click a link while signed into the WordPress admin. An external contractor or contributor could host or send the crafted request used to trigger the action. If the administrator performs the action, booking records may be added, removed, or altered without authorization.
Practical consequences include inaccurate booking records, scheduling conflicts, billing or reservation errors, and additional administrative overhead to detect and correct modified orders. While the CVSS data indicates no direct confidentiality loss, manipulation of booking records can indirectly increase the risk of social engineering or targeted phishing if attackers combine this capability with other information.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially administrative accounts and contributors with elevated capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and booking records for unusual behavior or unexpected changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
