Authorization Bypass in MotoPress Hotel Booking WordPress Plugin
CVE-2026-15237
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15237?
The MotoPress Hotel Booking WordPress plugin, prior to version 6.2.3, is susceptible to an authorization bypass vulnerability. This flaw allows unauthenticated users to exploit a vulnerable REST endpoint to create payment records for arbitrary bookings without proper checks. As a result, malicious actors can falsely label bookings as paid, leading to potential financial losses and undermining the integrity of the booking system.
Affected Version(s)
MotoPress Hotel Booking 0 < 6.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.