CVE-2026-13145

The CVE-2026-13145 entry affects the WP Travel WordPress plugin, specifically versions prior to 11.8.1. The vulnerability, described as an IDOR, occurs because the plugin does not verify that the booking on a customer’s account dashboard belongs to the current user. As a result, any logged-in use...

CVE-2026-9822 WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers

The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data...

CVE-2022-0720

The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it...