Skip to content
Sign in
4.3 Medium

CVE-2026-15235 The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a…

Description

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.

Affected products and versions

Product Affected versions Fixed in
MotoPress Hotel Booking 6.0 earliest → < 6.0.4 6.0.4

Other CVEs of MotoPress Hotel Booking

The 3 CVEs of MotoPress Hotel Booking →
CVE-2026-15238 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer… 5.4 Medium CVE-2026-15237 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a… 5.3 Medium
Track this CVE