CVE-2026-9822 describes an improper access control vulnerability in the WP Hotel Booking plugin for WordPress. Versions prior to 2.3.1 do not enforce capability checks in multiple AJAX handlers, which permits authenticated users with minimal privileges (Subscriber role) to access sensitive information including other users' booking details, active coupons, and pricing data. This vulnerability arises from missing or insufficient authorization checks in the plugin's AJAX endpoints. There is no CVSS score or vendor advisory indicating patch availability or mitigation status at this time.

Authenticated users with Subscriber-level access can access sensitive information that should be restricted, such as other users' booking line items, active coupons, and pricing data. This could lead to unauthorized disclosure of confidential business and customer information. There is no indication of remote code execution or privilege escalation beyond data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting Subscriber-level user access or disabling the affected AJAX handlers if feasible. Monitor the vendor's channels for updates or patches addressing this vulnerability.