Wyndham left a hardcoded credential in its customer app, and that let anyone access customer data.
A hardcoded credential is a password or access key written directly into an app's code instead of being kept on the company's servers. Every person who installs the app receives that code, so anything inside it can be pulled out by someone willing to look. That is why security guidance treats the practice as a basic error rather than an exotic one.
Wyndham, the hotel company, would not say whether it has the ability to check for past unauthorized access. That detail matters more than the flaw itself. Removing a key and issuing a new one is a routine fix. Working out who used the old one is harder, and it depends on whether a company keeps records detailed enough to tell its own app's requests from a stranger's.
The gap is the one between a flaw and a breach. A flaw is an unlocked door; a breach means someone walked through it. Here the first is established, and the second cannot be answered from anything Wyndham has said. Without usable logs, the company cannot rule out earlier access, and customers whose data sat behind that credential have no way to rule it out either.
The open question is whether Wyndham can answer the logging question at all. If it can, it owes customers a clear statement of what it found. If it cannot, that is its own disclosure.