Subscriber-level data disclosure via unchecked AJAX handlers

Missing authorization in ThimPress WP Hotel Booking before 2.3.1 allows remote authenticated users to read booking and pricing data. The hotel_booking_load_order_item, hotel_booking_load_coupon_ajax, and hotel_booking_load_other_full_calendar AJAX actions accept a nonce exposed in hotel_settings but perform no capability check before returning records selected by request parameters. A Subscriber account therefore suffices to read other users' booking line items, enumerate active coupon codes, and obtain room pricing without altering data.