← CVE Intelligence

CVE-2026-15238

Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR PUBLISHED

Description (CNA)

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

Affected (CNA)

Vendor / productVersions
Unknown / MotoPress Hotel Bookingaffected 0 before 6.2.3

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.