Skip to content
Sign in
5.4 Medium

CVE-2026-15238 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer…

Description

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

Affected products and versions

Product Affected versions Fixed in
MotoPress Hotel Booking 6.2 earliest → < 6.2.3 6.2.3

Other CVEs of MotoPress Hotel Booking

The 3 CVEs of MotoPress Hotel Booking →
CVE-2026-15237 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a… 5.3 Medium CVE-2026-15235 The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a… 4.3 Medium
Track this CVE