CVE-2026-15238
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 10, 2026
Vendor
unknown
Description
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.