Medium severity · published Oct 29, 2026
CVE-2026-118084
WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
New
6.5
CVSS
–
EPSS
No
On KEV
Description
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HB
Hotel Booking · nicdark
through 3.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118084
patchstack.com
https://patchstack.com/database/wordpress/plugin/nd-booking/vulnerability/wordpress-hotel-booking-plugin-3-8-insecure-direct-object-references-idor-vulnerability?_s_id=cve
More from Hotel Booking
8.1
CVE-2025-39526
WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability
7.5
CVE-2025-53259
WordPress Hotel Booking plugin <= 3.7 - Local File Inclusion Vulnerability
7.5
CVE-2025-47498
WordPress Hotel Booking plugin <= 3.6 - Local File Inclusion Vulnerability
7.1
CVE-2026-39784
WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
5.4
CVE-2022-29443
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress