CVE-2024-12370 describes an improper access control vulnerability (CWE-284) in the WP Hotel Booking plugin for WordPress, affecting all versions up to and including 2.1.5. The flaw arises from the absence of a capability check during the process of adding rooms, which allows unauthenticated attackers to add rooms with arbitrary custom prices. This unauthorized modification of booking data could impact the integrity of the plugin's data management. The vulnerability is remotely exploitable without authentication and requires no user interaction.

The vulnerability allows an unauthenticated attacker to modify booking data by adding rooms with custom prices, potentially disrupting hotel booking operations or causing inaccurate pricing information. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative functions and monitor for unauthorized changes. Avoid using affected versions in production environments if possible.