{"id":"CVE-2026-84166","published":"2026-10-12T06:17:00.300","lastModified":"2026-10-13T16:29:21.907","description":"The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/b3193e98-4b40-4fba-995d-a3ed897f852c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}