Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: MotoPress Hotel Booking 6.2.3 Clear all filters
TI-2026-12828 CVE-2026-15238 · GHSA-2r7r-792g-6mpg

Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

Priority LOW 24

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0023 Published 2026-08-10 Fixed in 6.2.3 CWE-639
TI-2026-12827 CVE-2026-15237 · GHSA-vqh4-pqm8-4r46

Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

Priority LOW 30

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-08-10 Fixed in 6.2.3 CWE-862