CVE-2024-12370CWE-284

WP Hotel Booking <= 2.1.5 - Missing Authorization

Medium · published January 17, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms with custom prices.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-01-17T08:25Z
EPSS history
Timeline
  • 17 JAN 08:25Z
    WP Hotel Booking <= 2.1.5 - Missing Authorization
    cvelistv5