Threats tagged 'ghsa-gr3g-w52p-ff6r'

CVE-2026-15152 is a vulnerability in the WP Hotel Booking WordPress plugin before version 2.3.2. The plugin fails to verify that payment notifications correspond to payments made to the site's own merchant account and does not confirm that the paid amount matches the booking total. This flaw allows unauthenticated users to have their bookings marked as fully paid without any actual payment reaching the site owner.