CVE-2026-15235 in Hotel Booking Plugin
Summary
by MITRE • 07/30/2026
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in the MotoPress Hotel Booking WordPress plugin affects versions prior to 6.0.4 and represents a critical access control flaw that undermines the privacy and security of customer data within hotel booking systems. This issue stems from the plugin's failure to implement proper capability checks within its AJAX endpoints, specifically when returning comprehensive customer information. The flaw allows authenticated users with minimal privileges such as subscribers or contributors to exploit this vulnerability and access personal data belonging to other customers without proper authorization. From a cybersecurity perspective, this represents a classic privilege escalation scenario where insufficient access controls enable unauthorized data exposure.
The technical implementation of this vulnerability demonstrates a failure in the plugin's security architecture, particularly around input validation and access control mechanisms. When an authenticated user makes an AJAX request to retrieve booking details, the system does not verify whether the requesting user has appropriate permissions to view the specific customer information being requested. This weakness aligns with CWE-284 Access Control Issues, specifically targeting improper access control in web applications where unauthorized users can access restricted resources through API endpoints or AJAX handlers. The vulnerability exists because the plugin's AJAX action lacks proper user role validation and capability checks that should be enforced before any sensitive data is returned to client-side requests.
The operational impact of this vulnerability extends beyond simple data exposure, as it creates significant privacy risks for hotel booking systems that rely on WordPress plugins for their operations. Attackers with low-privileged accounts can systematically harvest personal information from multiple customers, potentially enabling identity theft, targeted phishing attacks, or other malicious activities. The exposed data includes sensitive personal information such as names, email addresses, phone numbers, and physical addresses, which collectively constitutes personally identifiable information under various privacy regulations including GDPR, CCPA, and other data protection frameworks. This vulnerability essentially allows for the creation of comprehensive customer profiles from seemingly benign booking systems, representing a serious breach of user trust and potential regulatory violations.
Organizations using affected versions of the MotoPress Hotel Booking plugin must implement immediate mitigations to protect their customers' personal data and maintain compliance with privacy regulations. The most straightforward solution involves updating to version 6.0.4 or later, where the capability checks have been properly implemented to prevent unauthorized access to customer information. System administrators should also consider implementing additional monitoring mechanisms to detect unusual patterns of data access within their booking systems. From an ATT&CK framework perspective, this vulnerability maps to techniques involving credential access and data exposure, specifically T1078 Valid Accounts for the use of low-privileged accounts and T1567 Exfiltration Over Web Service for the unauthorized data retrieval process. Organizations should also review their overall WordPress security posture, ensuring that all plugins and themes implement proper access controls and that regular security audits are conducted to identify similar vulnerabilities in their web applications.