CVE-2026-9822: WP Hotel Booking Information Disclosure

CVE-2026-9822 Overview

CVE-2026-9822 affects the WP Hotel Booking WordPress plugin in versions prior to 2.3.1. The plugin fails to enforce capability checks in several AJAX handlers. Authenticated users with Subscriber-level access can read other users' booking line items, enumerate active coupons, and read pricing data. The flaw stems from Broken Access Control on internal AJAX endpoints that should be restricted to administrators or booking owners.

Exploitation requires only a low-privilege authenticated session, which is trivial to obtain on sites that allow open user registration. The disclosure exposes sensitive customer and commercial data without requiring user interaction.

Critical Impact
Subscriber-level accounts can exfiltrate other users' reservation details, coupon codes, and pricing data via unprotected AJAX handlers in WP Hotel Booking.

Affected Products

WP Hotel Booking WordPress plugin versions before 2.3.1
WordPress sites permitting Subscriber-level registration with the plugin installed
Hospitality and booking sites relying on WP Hotel Booking for reservations and coupons

Discovery Timeline

2026-06-19 - CVE-2026-9822 published to the National Vulnerability Database
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-9822

Vulnerability Analysis

The vulnerability is a Broken Access Control (Missing Authorization) issue in multiple AJAX handlers registered by WP Hotel Booking. WordPress AJAX endpoints registered through wp_ajax_{action} execute in an authenticated context. Developers must explicitly enforce capability checks using current_user_can() and validate nonces with check_ajax_referer().

In affected versions, several handlers omit these checks. Any authenticated user, including a Subscriber, can invoke the endpoints and receive data belonging to other accounts. The exposed data includes booking line items containing guest information, active coupon codes that can be reused at checkout, and pricing structures that may include negotiated or hidden rates.

The attack is performed over the network against wp-admin/admin-ajax.php using standard HTTP requests carrying a valid authentication cookie.

Root Cause

The root cause is the absence of authorization logic inside the AJAX callback functions. The handlers process the request and return data without verifying that the caller owns the requested booking or possesses an administrative capability such as manage_options or a plugin-specific role. Subscriber is the lowest WordPress role and should not have access to any booking metadata belonging to other users.

Attack Vector

An attacker registers a Subscriber account or uses any existing low-privilege credential. The attacker then issues authenticated POST requests to admin-ajax.php specifying the vulnerable plugin actions. The server returns booking records, coupon listings, and pricing data in the JSON response. No privilege escalation is required to read the data, and no user interaction is needed.

No public proof-of-concept code is referenced in the advisory. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-9822

Indicators of Compromise

Unusual volume of POST requests from a single authenticated session to /wp-admin/admin-ajax.php referencing WP Hotel Booking actions
Subscriber accounts generating large JSON responses from AJAX endpoints they should not access
Newly registered accounts immediately interacting with booking, coupon, or pricing AJAX actions

Detection Strategies

Review WordPress access logs for admin-ajax.php calls correlated with low-privilege user IDs and WP Hotel Booking action names
Deploy a Web Application Firewall rule to flag Subscriber sessions requesting booking or coupon AJAX actions
Audit the plugin source against version 2.3.1 to confirm whether current_user_can() and nonce checks are present in handlers

Monitoring Recommendations

Alert on bulk enumeration patterns such as repeated AJAX calls with incrementing booking identifiers
Monitor user registration spikes on sites running WP Hotel Booking, especially when followed by AJAX activity
Track coupon redemption rates for anomalies that may indicate leaked codes are being reused

How to Mitigate CVE-2026-9822

Immediate Actions Required

Update WP Hotel Booking to version 2.3.1 or later on all WordPress sites
Audit existing Subscriber accounts and remove any that appear to be attacker-created
Rotate active coupon codes that may have been enumerated prior to patching

Patch Information

The vendor resolved the issue in WP Hotel Booking 2.3.1 by adding capability and ownership checks to the affected AJAX handlers. Administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable open user registration in WordPress settings until the plugin is updated
Restrict access to /wp-admin/admin-ajax.php at the WAF for WP Hotel Booking action names when requested by non-administrators
Temporarily deactivate the WP Hotel Booking plugin if the site does not currently require live bookings

bash

# Update WP Hotel Booking via WP-CLI
wp plugin update wp-hotel-booking --version=2.3.1
wp plugin list --name=wp-hotel-booking --fields=name,status,version