CVE-2023-5651

Name of the Vulnerable Software and Affected Versions WP Hotel Booking WordPress plugin versions prior to 2.0.8

Description The issue concerns a lack of authorization and CSRF checks in the WP Hotel Booking WordPress plugin, which also fails to verify that the item to be deleted is indeed a package. This allows any authenticated user, including those with minimal privileges like subscribers, to delete arbitrary posts.

Recommendations For versions prior to 2.0.8, update to version 2.0.8 or later to resolve the issue.