CVE-2026-9822

CVE-2026-9822 concerns the WP Hotel Booking WordPress plugin prior to 2.3.1. According to the provided documents, several AJAX handlers do not enforce capability checks, enabling authenticated users with Subscriber-level access to 1) read other users’ booking line items, 2) enumerate active coupo...