CVE-2023-5651 — WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing …
Published: 2023-11-20 · CVSS: 5.4 · CVSS 3.1
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7