{"id":"CVE-2026-15152","state":"PUBLISHED","title":"WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass","description":"The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.","publishedAt":"2026-08-06T17:00:55.510Z","updatedAt":"2026-08-07T14:07:28.772Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"WPScan"},"assigner":"WPScan","products":["Unknown WP Hotel Booking"],"affected":[{"vendor":"Unknown","product":"WP Hotel Booking","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.3.2","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/e2435361-0a2a-4914-b4d8-7fb28386c4d3/"],"weaknesses":["CWE-345"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/15xxx/CVE-2026-15152.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-15152","state":"PUBLISHED","datePublished":"2026-08-06T17:00:55.510Z","dateUpdated":"2026-08-07T14:07:28.772Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-07-08T19:34:11.495Z"},"containers":{"cna":{"title":"WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass","descriptions":[{"lang":"en","value":"The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner."}],"affected":[{"vendor":"Unknown","product":"WP Hotel Booking","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.3.2","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/e2435361-0a2a-4914-b4d8-7fb28386c4d3/","tags":["exploit","vdb-entry","technical-description"]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"description":"CWE-345 Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-08-06T17:00:55.510Z"},"credits":[{"lang":"en","value":"Muni Nitish Kumar Yaddala","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-07T14:07:14.307211Z","id":"CVE-2026-15152","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-345","type":"CWE","lang":"en","description":"CWE-345 Insufficient Verification of Data Authenticity"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-07T14:07:28.772Z"}}]}}}