WP Hotel Booking Missing Capability Check Vulnerability Allowing Unauthorized Email Access

A vulnerability exists in the WP Hotel Booking plugin for WordPress, in versions through 2.1.6. The issue arises from a lack of proper capability checks on the 'hotel_booking_load_order_user' AJAX action. This flaw enables authenticated attackers with Subscriber-level access or higher to access and retrieve a list of registered user emails, leading to unauthorized data exposure.

Impact

Exploitation of this vulnerability allows for unauthorized access to user email addresses, potentially leading to further social engineering attacks or privacy violations.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'hotel_booking_load_order_user' AJAX action. This request will bypass the necessary capability checks and return a list of user emails.

Remediation

Users are advised to update the WP Hotel Booking plugin to version 2.1.7 or later, where this vulnerability has been patched.