Sensitive Information Exposure in WP Hotel Booking Plugin for WordPress

CVE-2025-14075

What is CVE-2025-14075?

The WP Hotel Booking plugin for WordPress has a vulnerability that allows unauthenticated users to access sensitive customer information. Specifically, the 'hotel_booking_fetch_customer_info' AJAX action can be exploited as it lacks proper capability checks and relies solely on a nonce for protection. This oversight permits attackers to retrieve sensitive details such as names, addresses, phone numbers, and email addresses by simply providing a valid email address and a publicly accessible nonce. Website owners using this plugin are advised to update to the latest version to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References