CVE-2025-14075 is a vulnerability classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) affecting the WP Hotel Booking plugin for WordPress, versions up to and including 2.2.7. The root cause is the improper exposure of the AJAX action 'hotel_booking_fetch_customer_info' to unauthenticated users. Instead of enforcing proper capability checks to verify user authorization, the plugin relies solely on a nonce token for protection. Since the nonce is publicly accessible, an attacker can supply a valid email address along with this nonce to the AJAX endpoint and retrieve sensitive customer details such as full names, physical addresses, phone numbers, and email addresses. This flaw compromises the confidentiality of customer data without impacting data integrity or system availability. The vulnerability can be exploited remotely over the network without any authentication or user interaction, making it relatively easy to exploit. Although no known exploits are currently in the wild, the exposure of personally identifiable information (PII) poses significant privacy risks and potential regulatory compliance issues, especially under GDPR. The vulnerability has a CVSS v3.1 base score of 5.3, reflecting its medium severity due to the ease of exploitation and the sensitivity of the data exposed. No official patches or updates are currently linked, so affected organizations must monitor vendor communications closely. The vulnerability is particularly relevant to organizations in the hospitality industry using this plugin to manage bookings and customer data on WordPress sites.

For European organizations, the exposure of sensitive customer information can lead to multiple adverse effects. Firstly, it risks violating the EU's General Data Protection Regulation (GDPR), which mandates strict controls over personal data, potentially resulting in heavy fines and reputational damage. Hospitality businesses relying on WP Hotel Booking may suffer loss of customer trust if personal data such as names, addresses, phone numbers, and emails are leaked. This can also facilitate targeted phishing attacks, identity theft, and social engineering campaigns against affected customers. The breach of confidentiality could disrupt business operations indirectly by necessitating incident response, customer notifications, and legal consultations. Although the vulnerability does not affect system integrity or availability, the privacy impact alone is significant given the nature of the data exposed. European tourism-heavy economies and businesses with large customer bases are particularly vulnerable to these consequences.

Organizations should immediately audit their WordPress installations to identify if the WP Hotel Booking plugin is in use and confirm the version. Until an official patch is released, administrators should consider disabling or restricting access to the 'hotel_booking_fetch_customer_info' AJAX action by implementing server-side access controls that enforce user authentication and capability checks beyond nonce validation. Web application firewalls (WAFs) can be configured to block suspicious AJAX requests targeting this endpoint, especially those originating from unauthenticated sources. Monitoring web server logs for unusual requests to this AJAX action can help detect exploitation attempts. Additionally, organizations should review and minimize the exposure of nonces in publicly accessible areas of the website to reduce attack surface. Once a vendor patch is available, prompt application of updates is critical. Finally, organizations should prepare incident response plans to address potential data breaches involving customer information and ensure compliance with GDPR notification requirements.