Medium severity5.3NVD Advisory· Published Aug 6, 2026

CVE-2026-15149

Description

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Wp Hotel Bookingllm-fuzzy
Range: <2.3.3
Package: https://wordpress.org/plugins/wp-hotel-booking

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/9c1df017-dfa5-43c4-b31e-43c9315edab1/nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000