Motopress Hotel Booking
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:motopress_hotel_booking:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Motopress Hotel Booking (80e23d05-b1db-5930-b01f-be44e07d4c42) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15235 |
vulnerable | 2026-09-16 04:33:06.909569 |
Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.
Published: 2026-07-30T06:00:07.700Z
Updated: 2026-07-30T18:25:44.439Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15238 |
vulnerable | 2026-09-16 04:33:06.763816 |
Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
Published: 2026-08-10T06:00:15.781Z
Updated: 2026-08-11T20:38:42.487Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15237 |
vulnerable | 2026-09-16 04:33:06.250058 |
Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
Published: 2026-08-10T06:00:15.608Z
Updated: 2026-08-11T20:38:01.388Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.