Unauthorized Data Modification in WP Hotel Booking Plugin for WordPress

CVE-2024-12370

What is CVE-2024-12370?

The WP Hotel Booking plugin for WordPress is susceptible to a security flaw where an absence of proper capability checks permits unauthenticated users to add rooms with arbitrary prices. This vulnerability affects all versions up to and including 2.1.5, potentially leading to unauthorized alterations to the hotel's room inventory, posing significant risks to site administrators and customers alike.

References