CVE-2026-15149: unknown wp hotel booking Improper Input Validation

Vulnerability summary

CVE-2026-15149 is a medium (CVSS 5.3) Improper Input Validation vulnerability in unknown wp hotel booking. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.3.3.

Timeline

1. 06-08-2026
   PublishedVulnerability first disclosed.
2. 07-08-2026
   Last modifiedVulnerability information updated.

Description

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-472External Control of Assumed-Immutable Web ParameterThe web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
• CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.