CVE-2026-9822Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/107fe41a-c5d9-4547-b413-bbd77cbab986/

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew136d
Disclosure
CVE-2026-9822 The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-leve… https://www.cve.org/CVERecord?id=CVE-2026-9822
Post summary
The WP Hotel Booking plugin prior to version 2.3.1 fails to enforce capability checks in its AJAX handlers, creating a privilege‑escalation vulnerability for authenticated users with subscriber-level access.
00000204
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-9822 Insufficient Capability Checks in WP Hotel Booking Plugin Before 2.3.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9822
Post summary
The post announces CVE-2026-9822, noting insufficient capability checks in WP Hotel Booking plugin versions prior to 2.3.1.
0000041
4.1K followersView on X

Explore more

Back to dashboard