CVE-2026-15149

Deferred Deferred - Pending Action

WP Hotel Booking Plugin Cart Manipulation Flaw

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-15149

Affected Vendors & Products

Vendor	Product	Version / Range
wp_hotel_booking	wp_hotel_booking	to 2.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-472	The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

The WP Hotel Booking WordPress plugin before version 2.3.3 has a flaw where it does not validate that room quantities and order totals are non-negative during booking. It relies on data controlled by the client, allowing unauthenticated users to manipulate cart details to create reservations for free or at reduced prices.

Detection Guidance

To detect this vulnerability, inspect the WP Hotel Booking plugin version. If it is below 2.3.3, the system is vulnerable. Check for unauthorized reservations with negative or zero prices in order logs.

Impact Analysis

Unauthenticated attackers could exploit this to book hotel rooms for free or at a much lower price by altering cart data. This could lead to financial losses for the hotel or booking platform and disrupt legitimate reservations.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized or improperly priced bookings, which may lead to data processing inconsistencies or financial discrepancies. However, the specific impact on compliance depends on how the plugin handles personal data and financial transactions in bookings.

Mitigation Strategies

Update the WP Hotel Booking WordPress plugin to version 2.3.3 or later to address the issue with room quantities and order totals.

Hi! I’m here to help you understand CVE-2026-15149. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70