Sensitive Information Exposure in WP Hotel Booking Plugin for WordPress

CVE-2025-14075

What is CVE-2025-14075?

The WP Hotel Booking plugin for WordPress has a vulnerability that allows unauthenticated users to access sensitive customer information. Specifically, the 'hotel_booking_fetch_customer_info' AJAX action can be exploited as it lacks proper capability checks and relies solely on a nonce for protection. This oversight permits attackers to retrieve sensitive details such as names, addresses, phone numbers, and email addresses by simply providing a valid email address and a publicly accessible nonce. Website owners using this plugin are advised to update to the latest version to mitigate this risk.

References