Medium severity5.3NVD Advisory· Published Aug 10, 2026· Updated Aug 26, 2026
CVE-2026-15237
CVE-2026-15237
Description
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<6.2.3+ 1 more
- (no CPE)range: <6.2.3
- (no CPE)range: <6.2.3
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.