WP Hotel Booking Plugin Cart Manipulation Flaw

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-15149

Affected Vendors & Products

Vendor	Product	Version / Range
wp_hotel_booking	wp_hotel_booking	to 2.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

The WP Hotel Booking WordPress plugin before version 2.3.3 has a flaw where it does not validate that room quantities and order totals are non-negative during booking. It relies on data controlled by the client, allowing unauthenticated users to manipulate cart details to create reservations for free or at reduced prices.

Impact Analysis

Unauthenticated attackers could exploit this to book hotel rooms for free or at a much lower price by altering cart data. This could lead to financial losses for the hotel or booking platform and disrupt legitimate reservations.

Mitigation Strategies

Update the WP Hotel Booking WordPress plugin to version 2.3.3 or later to address the issue with room quantities and order totals.

Hi! I’m here to help you understand CVE-2026-15149. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70