CVE-2026-15152 WP Hotel Booking CVE debrief

Who should care

Site owners using the WP Hotel Booking plugin, security teams monitoring WordPress vulnerabilities, and users of the affected plugin should be aware of this vulnerability and take necessary precautions to protect their systems. This includes reviewing and updating the plugin to version 2.3.2 or later, verifying payment notifications, and monitoring booking transactions for suspicious activity. Additionally, site owners should consider implementing additional security measures to prevent unauthorized access and financial losses.

Technical summary

The WP Hotel Booking WordPress plugin before 2.3.2 is vulnerable to unauthorized bookings due to a flawed payment notification verification process. The plugin fails to verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total. This allows attackers to mark bookings as fully paid without making a payment, potentially leading to financial losses for site owners. A thorough review of the plugin's code and configurations is recommended to understand the full scope of the vulnerability and to identify potential mitigations.

Defensive priority

Medium priority given the CVSS score of 5.3 and the potential for financial loss.

Recommended defensive actions

• Review and update the WP Hotel Booking plugin to version 2.3.2 or later.
• Verify payment notifications to ensure they correspond to payments made to the site's own merchant account.
• Monitor booking transactions for suspicious activity.
• Implement additional security measures to prevent unauthorized access.
• Conduct a thorough review of the plugin's code and configurations to identify potential vulnerabilities.
• Perform regular security audits to detect and address any potential issues.
• Consider implementing compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent attacks.

Evidence notes

Evidence from WPScan indicates a vulnerability in the WP Hotel Booking WordPress plugin. The CVE record and NVD entry provide additional context. WPScan's findings suggest that the plugin's payment notification verification process is flawed, allowing unauthorized bookings. Further review of the plugin's code and configurations is recommended to understand the full scope of the vulnerability. Defenders should verify payment notifications and booking transactions to ensure the integrity of the system.

Official resources