CVE-2025-49918: 
WordPress vulnerability analysis and mitigation

CVE-2025-49918 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) affecting the VikBooking Hotel Booking Engine & PMS WordPress plugin by e4jvikwp. All versions up to and including 1.8.2 are vulnerable; version 1.8.3 contains the fix. The vulnerability was reported on October 8, 2025, published by Patchstack on November 7, 2025, and assigned a CVE on December 18, 2025. It carries a CVSS v3.1 base score of 5.9 (Medium) (Patchstack).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses or transmitted data that should not be accessible to regular or unauthenticated users. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction and involves high attack complexity over a network vector, suggesting the attacker may need to manipulate or observe a specific request/response cycle. The vulnerability is categorized under OWASP Top 10 A1: Broken Access Control and enables retrieval of embedded sensitive data (Patchstack).

Successful exploitation allows a malicious actor to view sensitive information that is normally restricted from regular or unauthenticated users, with a high confidentiality impact and low integrity impact per the CVSS scoring. The exposed data could potentially be leveraged to exploit other weaknesses in the affected WordPress site or its underlying systems. Availability is not directly impacted, but the exposure of sensitive booking or PMS data could have significant privacy and compliance implications for hotel operators and their guests (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-49918. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

The vendor has released version 1.8.3 of the VikBooking Hotel Booking Engine & PMS plugin, which resolves this vulnerability. Site administrators should update to version 1.8.3 or later immediately. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated, and auto-update for vulnerable plugins can be enabled via the Patchstack dashboard (Patchstack).