WordPress Plugin Vulnerabilities

Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

Description

The plugin does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.

Proof of Concept

Affects Plugins

Plugin icon
motopress-hotel-booking-lite
Fixed in 6.2.3

References

CVE
CVE-2026-15238

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Haitam Lazaar
Submitter
Haitam Lazaar
Submitter website
https://www.linkedin.com/in/haitam-lazaar/
Verified
Yes
WPVDB ID
7283a28a-7241-4b9e-8fc5-5b427191c80e

Timeline

Publicly Published
2026-08-06 (about 4 days ago)
Added
2026-08-06 (about 3 days ago)
Last Updated
2026-08-06 (about 3 days ago)

Other

Published
Title
Published
2023-01-30
Title
WP Private Message < 1.0.6 - Private Message Disclosure via IDOR
Published
2026-06-30
Title
Kadence Blocks < 3.7.8 - Contributor+ Arbitrary Optimizer Data Read/Modification/Deletion via IDOR in post_path
Published
2025-07-25
Title
MinimogWP < 3.9.1 - Unauthenticated Price Manipulation
Published
2026-07-08
Title
Easy Appointments <= 3.12.26 - Subscriber+ Customer PII Disclosure via IDOR
Published
2025-04-14
Title
Projectopia <= 5.1.23 - Unauthenticated Privilege Escalation via Account Takeover