CVE-2026-15235 in Hotel Booking Plugin
الملخص
بحسب MITRE • 30/07/2026
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.