CVE-2026-15238: CWE-639 Authorization Bypass Through User-Controlled Key in MotoPress Hotel Booking
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
AI Analysis
Technical Summary
CVE-2026-15238 is an authorization bypass vulnerability in the MotoPress Hotel Booking WordPress plugin prior to version 6.2.3. The flaw arises because the plugin fails to verify that the authenticated user owns the customer record before permitting updates. This allows any authenticated user with a low-privileged account, such as Subscriber or higher, to modify or overwrite personal data of any customer by providing an arbitrary identifier, effectively bypassing intended access controls.
Potential Impact
An attacker with any authenticated low-privileged account can alter or overwrite personal data of other customers. This can lead to unauthorized data modification, potential privacy violations, and data integrity issues within the affected WordPress site using the vulnerable plugin.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles that can authenticate or update customer records, and monitor for suspicious activity related to customer data modifications.
CVE-2026-15238: CWE-639 Authorization Bypass Through User-Controlled Key in MotoPress Hotel Booking
Description
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15238 is an authorization bypass vulnerability in the MotoPress Hotel Booking WordPress plugin prior to version 6.2.3. The flaw arises because the plugin fails to verify that the authenticated user owns the customer record before permitting updates. This allows any authenticated user with a low-privileged account, such as Subscriber or higher, to modify or overwrite personal data of any customer by providing an arbitrary identifier, effectively bypassing intended access controls.
Potential Impact
An attacker with any authenticated low-privileged account can alter or overwrite personal data of other customers. This can lead to unauthorized data modification, potential privacy violations, and data integrity issues within the affected WordPress site using the vulnerable plugin.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles that can authenticate or update customer records, and monitor for suspicious activity related to customer data modifications.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-09T11:42:12.464Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7972acbf8831d5392fafb7
Added to database: 08/10/2026, 06:41:48 UTC
Last enriched: 08/10/2026, 07:18:24 UTC
Last updated: 08/11/2026, 02:22:04 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.