CVE-2026-15149CWE-20CWE-472
CVE-2026-15149
Medium · published August 7, 2026
What it is
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00324 · 24.2th percentile
- Weaknesses
- CWE-20 · Improper Input Validation; CWE-472 · External Control of Assumed-Immutable Web Parameter
- Published
- 2026-08-07T02:16Z
References (1)
EPSS history
Timeline