medium5.4
CVE-2026-15238
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user wi…
Impact
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
Affected products
| Product | Affected versions |
|---|---|
| MotoPress Hotel Booking WordPress Plugin | before 6.2.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.