CVE-2026-13145

The WP Travel WordPress plugin, in versions prior to 11.8.1 , contains an Insecure Direct Object Reference (IDOR) vulnerability. The plugin fails to verify that a requested booking on the customer account dashboard belongs to the currently logged-in user. This allows any authenticated user to acc...

CVE-2026-9822 WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data...

CVE-2022-0720

The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it...