The WP Hotel Booking WordPress plugin, when run at a version earlier than 2.3.1, contains several AJAX handlers that lack proper capability checks. An authenticated user with a Subscriber role can trigger these handlers to read the booking line items of other users, enumerate active coupons, and retrieve pricing data. This flaw does not allow code execution or modification of data, but it exposes private booking information and other sensitive data to users who should not have access.

The vulnerability affects installations of the WP Hotel Booking plugin with any version below 2.3.1. Users running this software on any WordPress site are impacted if they rely on the default Subscriber role.

The exploit requires the attacker to be logged in as a Subscriber; no additional privileges are needed. Because the issue is confined to read‑only data, the risk level is moderate, though it can undermine customer privacy. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is likely exploitable through simple AJAX requests after authentication, making it comparatively easy to leverage within an authenticated environment.