CVE-2026-15235 is an information exposure vulnerability (CWE-200) in the MotoPress Hotel Booking WordPress plugin before version 6.0.4. The flaw arises because the plugin does not perform proper capability checks before returning sensitive booking customer details through an AJAX endpoint. As a result, any authenticated user with at least Subscriber-level privileges can retrieve personal information of any customer, including name, email, phone, and address. This vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), reflecting the network attack vector, low attack complexity, and limited privileges required, but only confidentiality impact.

An attacker with any authenticated low-privileged account on a vulnerable WordPress site can access sensitive personal information of other customers who made bookings. This exposure includes names, email addresses, phone numbers, and physical addresses. There is no impact on integrity or availability. The vulnerability could lead to privacy violations and potential misuse of customer data.

A fixed version 6.0.4 of the MotoPress Hotel Booking plugin addresses this vulnerability by implementing proper capability checks before returning customer booking details. Users should upgrade to version 6.0.4 or later to remediate this issue. No official patch link or advisory is provided in the input, so verify with the vendor for the latest remediation guidance. Until upgraded, restrict authenticated user roles to trusted users only.