CVE-2026-15149 — WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on clie…
Published: 2026-08-06 · CVSS: 5.3 · CVSS 3.1
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7