Input validation vulnerability in WP Hotel Booking 2.1.9

The WP Hotel Booking plugin for WordPress has a security issue in versions up to 2.1.9. This happens because the save() function does not properly check for a special code called a “nonce.” As a result, someone who is not logged in and has no special permissions can change the plugin’s settings if they can trick the website’s administrator into doing something, like clicking on a link.