CVE-2026-15152
WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 6, 2026
- Updated
- Aug 7, 2026
- Reserved
- Jul 8, 2026
Description
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | WPScan |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
WP Hotel BookingUnknown |
|
References
- https://wpscan.com/vulnerability/e2435361-0a2a-4914-b4d8-7fb28386c4d3/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.