CVE-2026-15235: MotoPress Hotel Booking sensitive data disclosure in AJAX action

CVE-2026-15235 · Severity: info · CVSS 4.3 · Published 2026-07-30

The MotoPress Hotel Booking plugin for WordPress, which manages reservations and customer information, contains a security flaw that exposes sensitive guest data. Any logged-in user, even those with the lowest level of access like a subscriber, can view the full personal details of any customer who has made a booking. This includes names, email addresses, phone numbers, and physical addresses, potentially leading to privacy violations and identity theft risks.

Technologies: MotoPress Hotel Booking Lite. Vendors: MotoPress.

Quick answers

Is CVE-2026-15235 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15235 being exploited in the wild.
How severe is CVE-2026-15235?
Informational severity, with a CVSS score of 4.3, published 30 July 2026.
Which products and versions are affected?
MotoPress Hotel Booking Lite < 6.0.4.
Is there a fix for CVE-2026-15235?
A patch was published on 2026-07-09: Fixed in version 6.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15235 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-15235?
Check whether you run MotoPress Hotel Booking Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The MotoPress Hotel Booking (and Hotel Booking Lite) plugin fails to implement proper authorization checks in the 'mphb_get_admin_calendar_booking_info' AJAX action. While the action requires a valid nonce, the plugin localizes this nonce for all logged-in users, including those with Subscriber-level privileges. An attacker can retrieve this nonce and then send a POST request to admin-ajax.php, iterating through 'booking_id' parameters to extract PII such as name, email, phone, and address from the JSON response. The vulnerability is classified as an Improper Authorization leading to Sensitive Data Exposure (CWE-200). The issue is resolved in version 6.0.4.

Affected products

  • MotoPress Hotel Booking Lite < 6.0.4

Timeline

  • 2026-07-09: disclosed: Publicly published by WPScan
  • 2026-07-30: advisory: NVD publication date
  • 2026-07-09: patched: Fixed in version 6.0.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.