CVE-2025-14075 - WP Hotel Booking <= 2.2.7 - unauthenticated sensitive information exposure via '...

CVE ID : CVE-2025-14075 Published : Jan. 17, 2026, 3:16 a.m. | 1 hour, 9 minutes ago Description : The WP Hotel Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.7. This is due to the plugin exposing the 'hotel_booking_fetch_customer_info' AJAX action to unauthenticated users without proper capability checks, relying only on a nonce for protection. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including full names, addresses, phone numbers, and email addresses by providing a valid email address and a publicly accessible nonce. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...