CVE-2026-9822— WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers
Quick assessment
Affected
Unknown WP Hotel Booking
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
thimpress wp hotel booking是thimpress公司的一款酒店预订管理插件。 ThimPress WP Hotel Booking 2.3.1之前版本存在权限许可和访问控制问题漏洞，该漏洞源于未在多个AJAX处理器中执行权限检查，可能导致通过身份验证的用户读取其他用户的预订订单、枚举有效优惠券和读取定价数据。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Hotel Booking | < 2.3.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-9822
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
ThimPress wp hotel booking 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
thimpress wp hotel booking是thimpress公司的一款酒店预订管理插件。 ThimPress WP Hotel Booking 2.3.1之前版本存在权限许可和访问控制问题漏洞，该漏洞源于未在多个AJAX处理器中执行权限检查，可能导致通过身份验证的用户读取其他用户的预订订单、枚举有效优惠券和读取定价数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Hotel Booking | 0 ~ 2.3.1 | - |
|
II. Public POCs for CVE-2026-9822
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9822
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-9822 (1)
-
🔗 WP Hotel Booking < 2.3.1 – Subscriber+ Missing Authorization in Multiple AJAX Handlers | CVE 2026-9822 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
IV. Related Vulnerabilities
Same product: WP Hotel Booking
-
CVE-2026-15149
WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass vi -
CVE-2026-15152
WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment By -
CVE-2026-15153
WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via -
CVE-2026-15464
WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Sto -
CVE-2026-15094
WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting v
Same vendor: Unknown
-
CVE-2026-94274
YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Di -
CVE-2026-94297
Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitra -
CVE-2026-96886
Course Booking System < 7.0.9 - Unauthenticated Attendee PII -
CVE-2026-97316
Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF vi -
CVE-2026-92424
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Qu
V. Comments for CVE-2026-9822
No comments yet