Description
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nicdark | Hotel Booking | ≤ 3.8 | — |
Medium · 6.5
CVE-2026-118084
EUVD-2026-113001GHSA-868g-vqrm-6v47
WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
Published Oct 29, 2026 · Updated Oct 30, 2026 · Assigned by Patchstack