5.4
Moyenne
CVE-2026-15238 The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer…
Description
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MotoPress Hotel Booking 6.2 | premières → < 6.2.3 | 6.2.3 |