CVE-2025-14352 is an incorrect authorization vulnerability (CWE-863) in the Awesome Hotel Booking WordPress plugin by nahian91. The flaw exists because the plugin's room-single.php shortcode handler relies solely on nonce verification for authorization, without verifying user capabilities. This allows unauthenticated attackers who can obtain a valid nonce from the public booking form to modify arbitrary booking records. The vulnerability affects all versions up to and including 1.0.3. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

An unauthenticated attacker can modify booking records arbitrarily due to missing capability checks in the authorization process. This can lead to unauthorized data modification within the booking system. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

No official patch or fix is currently available as per the provided data. Users should monitor the vendor's channels for updates or patches addressing this authorization issue. Until a fix is released, consider restricting access to the booking modification functionality or implementing additional access controls at the web server or application level to prevent unauthorized modification. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.