Vulnerability · Published Aug 10, 2026 · Assigned by WPScan
CVE-2026-15237Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint
Medium 5.3
In plain English
A medium-severity missing authorization in MotoPress Hotel Booking from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 76.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | MotoPress Hotel Booking | 0 – before 6.2.3 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/b312a323-808c-497f-b67e-3b0acfcb8932/ exploit, vdb-entry, technical-description