Broken Access Control in Adivaha Flights & Hotels Booking Plugin for WordPress
CVE-2025-62916

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Flights & Hotels Booking WP Plugin
Vendor
CVE Published:
27 October 2025

What is CVE-2025-62916?

A missing authorization vulnerability exists in the Adivaha Flights & Hotels Booking WP Plugin, specifically affecting versions up to 3.1. This flaw can lead to unauthorized access due to incorrectly configured access control security levels. Attackers may exploit this vulnerability to gain elevated privileges, allowing them to manipulate sensitive booking data or perform actions without proper authentication, posing significant risks to website integrity and user trust.

Affected Version(s)

Flights & Hotels Booking WP Plugin 0 <= 3.1

References

https://patchstack.com/database/Wordpress/Plugin/adiaha-h...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Legion Hunter | Patchstack Bug Bounty Program
.