Live › vulnerability › CVE-2026-118084
The Hotel Booking WordPress plugin up to version 3.8 has an insecure direct object reference flaw affecting subscriber-level accounts. The sources do not state exactly which records an attacker can read or change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
No product ranges from the sources yet.
3.8 and older are listed as affected.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118084")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.