CVE-2026-15235 in Hotel Booking Plugin

Sumário

de MITRE • 30/07/2026

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsável: WPScan
• Reservar: 09/07/2026
• Divulgação: 30/07/2026
• Moderação: aceite
• Entrada: VDB-384601
• CPE: pronto
• CWE: CWE-200 (confirmado)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00224
• KEV: não
• Atividades: muito baixo
• Sector: Hostingprovider

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-15235
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-15235
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-15235/