CVE-2024-13447 is a missing authorization vulnerability (CWE-862) in the WP Hotel Booking WordPress plugin. The issue arises because the hotel_booking_load_order_user AJAX action lacks a capability check, enabling authenticated users with Subscriber-level privileges or higher to access registered user email addresses. This vulnerability affects all plugin versions up to and including 2.1.6. The CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a network attack vector with low attack complexity and requiring low privileges, resulting in limited confidentiality impact.

An authenticated attacker with Subscriber-level access or above can retrieve a list of registered user emails, leading to potential privacy violations and information disclosure. There is no impact on data integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for suspicious activity related to the hotel_booking_load_order_user AJAX action. Avoid granting unnecessary authenticated access to untrusted users.