An unauthenticated sensitive data exposure flaw in the Byteflows Travel & Hotel Booking plugin presents a high risk of unauthorized information disclosure.

This vulnerability is an exposure of sensitive system information to an unauthorized control sphere, categorized as CWE-497. The flaw allows an unauthenticated attacker to retrieve sensitive data from the application without requiring valid credentials.

Successful exploitation leads to the unauthorized disclosure of sensitive data, which may include customer booking details, system configuration, or internal business logic. With a CVSS score of 7.5, the impact is significant, potentially leading to privacy violations, regulatory non-compliance, and reputational damage.

Immediate Action: Update the Byteflows Travel & Hotel Booking plugin to version 1.0.1 or later immediately.

Proactive Monitoring: Review application logs for anomalous access requests targeting plugin files or directories that should be restricted to authenticated users.

Compensating Controls: Utilize a Web Application Firewall (WAF) to restrict external access to sensitive plugin endpoints and monitor for unauthorized data retrieval patterns.

Public Exploit Available: No

This vulnerability represents a significant security oversight that exposes sensitive information to the public internet. Organizations using this plugin should prioritize updating to the latest version to prevent potential data breaches. Immediate patching is the only effective way to remediate this exposure.