{"vulnerability": "CVE-2026-84166", "sightings": [{"uuid": "cb715325-5f91-468e-b637-1503c7c91681", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84166", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117426431045449277", "content": "CVE-2026-84166 Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.\nhttps://www.cve.org/CVERecord?id=CVE-2026-84166https://wpscan.com/vulnerability/b3193e98-4b40-4fba-995d-a3ed897f852c/#CVE_2026_84166#bot", "creation_timestamp": "2026-10-12T06:05:42.062240Z"}, {"uuid": "4cf96074-f43b-48df-9d6f-8e7cff59ebe3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84166", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/g6gdd4wzmdo3j", "content": "CVE-2026-84166 - Hotel Booking\nCVE ID : CVE-2026-84166\n \n Published : Oct. 12, 2026, 6 a.m. | 29\u00a0minutes ago\n \n Description : The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to...", "creation_timestamp": "2026-10-12T07:50:11.792470Z"}]}