Improper Record Verification in MotoPress Hotel Booking Plugin by MotoPress
CVE-2026-15238
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15238?
The MotoPress Hotel Booking WordPress plugin prior to version 6.2.3 features a serious flaw where it fails to ensure proper ownership of customer records during updates. This vulnerability permits any authenticated user with a low-privilege account, such as a Subscriber, to alter or overwrite the personal data of other customers simply by using an arbitrary identifier. This lack of access verification poses a significant risk of unauthorized data manipulation.
Affected Version(s)
MotoPress Hotel Booking 0 < 6.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.