5.3
Moyenne
CVE-2026-15152 The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a…
Description
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP Hotel Booking 2.3 | premières → < 2.3.2 | 2.3.2 |
Autres CVE de WP Hotel Booking
Les 8 CVE de WP Hotel Booking →
CVE-2026-15149
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total…
5.3
Moyenne
CVE-2026-15153
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an…
6.8
Moyenne
CVE-2026-9822
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers,…
6.5
Moyenne
CVE-2025-8942
The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an…
9.1
Critique