The Hoteler Booking WordPress plugin, in all releases up to 3.8, lacks CSRF protection for its administrative booking order management functions. This flaw permits an attacker who can convince a logged‑in administrator to visit a crafted URL or submit a forged form to create, delete, or modify booking orders at will. The effect is a loss of data integrity, potential billing errors, and disruption of service for guests and staff. The weakness is a classic cross‑site request forgery vulnerability.

Any WordPress site that runs Hotel Booking plugin version 3.8 or older is affected. The problem exists in the plugin itself, regardless of the surrounding WordPress configuration.

An attacker can achieve the impact by tricking an authenticated administrator into sending a malicious request; no additional privileges or exploit binaries are required. The CVSS score of 4.3 indicates low to moderate severity. Because the flaw is purely a missing CSRF token, the attack can be performed from a client‑side script or a simple link. No EPSS data or KEV listing is available, so the exploitation likelihood is unknown, but the lack of a protection mechanism indicates a high potential for abuse if an admin is susceptible to social engineering.