The Hotel Booking WordPress plugin up to version 3.8 fails to verify that a booking record belongs to the user requesting it, allowing an authenticated user—such as a Subscriber—to supply any booking identifier and read the full set of personal details for that booking, including name, email address, phone number and postal address. This flaw is an insecure direct object reference, classified as CWE‑639, and it results in a confidentiality breach of users’ personal identifiable information.

The affected product is the Hotel Booking WordPress plugin. Versions 3.8 and earlier are impacted as indicated by the plugin’s release history and the advisory’s mention of “≤ 3.8.” The plugin is distributed through the WordPress plugin repository and can be used on any WordPress installation that has the plugin enabled.

The vulnerability can be exploited by any user who has a legitimate WordPress account. No unauthenticated access or administrative privileges are needed. The attack vector is essentially any authenticated request that references a booking identifier. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, implying no public exploitation at the time of writing. Nevertheless, the CVSS score of 4.3 indicates low severity, but because the disclosed data is highly sensitive, the potential impact remains significant if an attacker obtains user credentials or exploits the flaw within a target site.