This vulnerability in WP Hotel Booking plugin versions up to 2.2.7 allows an attacker with limited privileges to expose sensitive system information that should not be accessible to them. The issue is classified as an exposure of sensitive data to an unauthorized control sphere, meaning that information intended to be protected can be retrieved by unauthorized users. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in limited confidentiality impact without affecting integrity or availability.

An attacker with some level of privileges can retrieve sensitive system information from the affected plugin, potentially aiding further attacks or reconnaissance. The confidentiality of system information is compromised, but there is no direct impact on data integrity or system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict plugin access to trusted users only and consider limiting privileges to reduce exposure risk.