Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-15237

Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Motopress Hotel Booking Wordpress
Products
Motopress Hotel Booking Wordpress
CVE-2026-15238

Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Motopress Hotel Booking Wordpress
Products
Motopress Hotel Booking Wordpress
CVE-2026-15235

Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Motopress Hotel Booking Wordpress
Products
Motopress Hotel Booking Wordpress