Description
Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.
Published: 2026-07-02
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Jetmonsters Hotel Booking Lite plugin has a flaw that leads to sensitive subscriber information being exposed in versions up to 6.0.3, allowing unauthorized individuals to access personal and booking details (CWE‑201).

Affected Systems

The vulnerability affects the Jetmonsters Hotel Booking Lite plugin, specifically versions 6.0.3 and earlier.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity risk, while an EPSS score of < 1% suggests a low probability of exploitation and the vulnerability is not listed in CISA KEV. The attack vector is not explicitly documented, but because the flaw permits unauthenticated viewing of subscriber data, it is inferred that an attacker could issue a request to a publicly exposed plugin endpoint to retrieve the information.

Generated by OpenCVE AI on July 21, 2026 at 11:57 UTC.

Remediation

Vendor Solution

Update the WordPress Hotel Booking Lite Plugin to the latest available version (at least 6.0.4).

OpenCVE Recommended Actions

  • Update the WordPress Hotel Booking Lite Plugin to version 6.0.4 or later, which removes the insecure handling of subscriber data (CWE‑201).
  • Remove any copies of older plugin versions from the WordPress installation.
  • Regularly check the vendor’s website for new releases and apply updates promptly.

Generated by OpenCVE AI on July 21, 2026 at 11:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Jetmonsters
Jetmonsters hotel Booking Lite
Wordpress
Wordpress wordpress
Vendors & Products Jetmonsters
Jetmonsters hotel Booking Lite
Wordpress
Wordpress wordpress

Thu, 02 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Description Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.
Title WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability
Weaknesses CWE-201
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Jetmonsters Hotel Booking Lite
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-02T12:43:26.221Z

Reserved: 2026-06-24T12:45:24.971Z

Link: CVE-2026-57347

cve-icon Vulnrichment

Updated: 2026-07-02T12:43:23.175Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T12:00:05Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data