medium5.3
CVE-2026-15237
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records…
Impact
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
Affected products
| Product | Affected versions |
|---|---|
| MotoPress Hotel Booking WordPress Plugin | before 6.2.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.