Quick answers
- Is CVE-2026-15237 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15237 being exploited in the wild.
- How severe is CVE-2026-15237?
- Medium severity, with a CVSS score of 5.3, published 10 August 2026.
- Which products and versions are affected?
- MotoPress Hotel Booking Lite before 6.2.3.
- Is there a fix for CVE-2026-15237?
- A patch was published on 2026-06-10: Fix released in version 6.2.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-15237 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-15237?
- Check whether you run MotoPress Hotel Booking Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control issue (CWE-862) in the `/wp-json/mphb/v1/checkout/payments` REST endpoint. The endpoint creates payment records without verifying user authentication or ownership of the targeted booking. An attacker can craft an unauthenticated POST request specifying an arbitrary booking ID and payment details to create a "Completed" payment record that never actually occurred. The endpoint processes requests from any origin without authorization, allowing iteration over booking IDs to falsely mark multiple bookings as paid. This affects MotoPress Hotel Booking (motopress-hotel-booking-lite) versions before 6.2.3, which is fixed in 6.2.3.
Affected products
- MotoPress Hotel Booking Lite before 6.2.3
Timeline
- 2026-08-06: disclosed
- 2026-06-10: patched: Fix released in version 6.2.3