CVE-2026-15238 in Hotel Booking Plugin

Riassunto

di MITRE • 10/08/2026

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsabile: WPScan
• Prenotare: 09/07/2026
• Divulgazione: 10/08/2026
• Moderazione: accettato
• Voce: VDB-387304
• CPE: pronto
• CWE: CWE-639 (confermato)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Attività: molto basso
• Settore: Hostingprovider

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-15238
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15238
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-15238/