# CVE-2026-15235: MotoPress Hotel Booking sensitive data disclosure in AJAX action

Source: https://junglewise.ai/threats/cve-2026-15235-motopress-hotel-booking-sensitive-data-disclosure-in-ajax-action  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-15235 · Severity: info · CVSS 4.3 · Published 2026-07-30

The MotoPress Hotel Booking plugin for WordPress, which manages reservations and customer information, contains a security flaw that exposes sensitive guest data. Any logged-in user, even those with the lowest level of access like a subscriber, can view the full personal details of any customer who has made a booking. This includes names, email addresses, phone numbers, and physical addresses, potentially leading to privacy violations and identity theft risks.

Technologies: [MotoPress Hotel Booking Lite](https://junglewise.ai/threats/technologies/hotel-booking-lite). Vendors: [MotoPress](https://junglewise.ai/threats/vendors/motopress).

## Quick answers

**Is CVE-2026-15235 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15235 being exploited in the wild.

**How severe is CVE-2026-15235?** Informational severity, with a CVSS score of 4.3, published 30 July 2026.

**Which products and versions are affected?** MotoPress Hotel Booking Lite < 6.0.4.

**Is there a fix for CVE-2026-15235?** A patch was published on 2026-07-09: Fixed in version 6.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15235 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15235?** Check whether you run MotoPress Hotel Booking Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MotoPress Hotel Booking (and Hotel Booking Lite) plugin fails to implement proper authorization checks in the 'mphb_get_admin_calendar_booking_info' AJAX action. While the action requires a valid nonce, the plugin localizes this nonce for all logged-in users, including those with Subscriber-level privileges. An attacker can retrieve this nonce and then send a POST request to admin-ajax.php, iterating through 'booking_id' parameters to extract PII such as name, email, phone, and address from the JSON response. The vulnerability is classified as an Improper Authorization leading to Sensitive Data Exposure (CWE-200). The issue is resolved in version 6.0.4.

## Affected products

- MotoPress Hotel Booking Lite < 6.0.4

## Timeline

- 2026-07-09: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD publication date
- 2026-07-09: patched: Fixed in version 6.0.4

## References

- [https://wpscan.com/vulnerability/c441d996-e21f-4a16-8dcc-0b0ed61aec76/](https://wpscan.com/vulnerability/c441d996-e21f-4a16-8dcc-0b0ed61aec76/)

## Related threats

- [MotoPress Hotel Booking authorization bypass in payment REST endpoint](https://junglewise.ai/threats/cve-2026-15237-motopress-hotel-booking-authorization-bypass-in-payment-rest)
- [MotoPress Hotel Booking Lite sensitive data exposure](https://junglewise.ai/threats/cve-2026-57347-motopress-hotel-booking-lite-sensitive-data-exposure)
- [MotoPress Hotel Booking Lite stored XSS in accommodation fields](https://junglewise.ai/threats/cve-2022-50948-motopress-hotel-booking-lite-stored-xss-in-accommodation-fields)