The WP Hotel Booking plugin (≤ 2.2.7) lacks proper capability checks for the `hotel_booking_fetch_customer_info` AJAX action. It relies only on a nonce, allowing any unauthenticated user to supply a valid email address and a publicly available nonce to retrieve private customer details such as names, addresses, phone numbers, and email addresses. This creates a confidentiality breach, exposing sensitive user data without authorization.

vulnerable systems run the ThimPress WP Hotel Booking WordPress plugin up to and including version 2.2.7.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests low current exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely over HTTP by sending a crafted AJAX request; no authentication or privileged access is required.