CVE-2026-84166

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request...

PT-2026-69349

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 Description An issue exists where the software fails to perform authorization or ownership checks on a REST endpoint used to create payment records. This allows unauthenticated...

ND Booking < 2.5 - Unauthenticated Options Change

The Hotel Booking WordPress plugin was affected by an Unauthenticated Options Change security vulnerability...