The vulnerability identified as CVE-2025-66078 affects jetmonsters Hotel Booking Lite plugin versions up to and including 5.2.3. It is classified as an improper control of code generation ('Code Injection') that permits remote code inclusion. This allows an attacker with high privileges to execute arbitrary code remotely, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and scope change with high impact on all security properties. No official patch or vendor advisory details are currently available.

Successful exploitation of this vulnerability could allow an attacker with high privileges to remotely execute arbitrary code on the affected system, leading to full compromise of the system's confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and limit privileges to trusted users only. Monitor for updates from the vendor and apply patches promptly once available.