Broken Access Control in Adivaha Flights & Hotels Booking Plugin for WordPress
CVE-2025-62916

8.8HIGH

Key Information:

Vendor

WordPress
Status
Flights & Hotels Booking WP Plugin
Vendor
CVE Published:
27 October 2025

What is CVE-2025-62916?

A missing authorization vulnerability exists in the Adivaha Flights & Hotels Booking WP Plugin, specifically affecting versions up to 3.1. This flaw can lead to unauthorized access due to incorrectly configured access control security levels. Attackers may exploit this vulnerability to gain elevated privileges, allowing them to manipulate sensitive booking data or perform actions without proper authentication, posing significant risks to website integrity and user trust.

Affected Version(s)

Flights &amp; Hotels Booking WP Plugin <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/adia...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Legion Hunter | Patchstack Bug Bounty Program
JSON
.
CVE-2025-62916 : Broken Access Control in Adivaha Flights & Hotels Booking Plugin for WordPress