Unrated severityNVD Advisory· Published Jul 30, 2026· Updated Jul 30, 2026
WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search
CVE-2026-15153
Description
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.3.2
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/0f678ab4-ec62-48a9-88c8-def3228ff725/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.