CVE-2026-15237 is a missing authorization (CWE-862) vulnerability in the MotoPress Hotel Booking WordPress plugin prior to version 6.2.3. The plugin fails to perform authorization or ownership checks on a REST endpoint responsible for creating payment records. As a result, unauthenticated attackers can create completed payment records against arbitrary bookings, falsely marking those bookings as paid. This vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability allows unauthenticated attackers to manipulate payment records by creating false completed payments for arbitrary bookings. This impacts the integrity of the booking and payment data, potentially leading to financial discrepancies or unauthorized booking confirmations. There is no impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST endpoint if possible or implement additional access controls at the web server or application firewall level to prevent unauthorized requests to the payment creation endpoint.