CVE-2024-13447: The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user…

PriorityP420medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

0.35%

26.5th percentile

The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a list of registered user emails.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
thimpress	wp_hotel_booking	< 2.1.7	2.1.7
thimpress	wp_hotel_booking	<= 2.1.6	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.