CVE-2026-15152 WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass
Unauthenticated attackers can bypass payment verification in WP Hotel Booking, marking bookings as paid without actual payment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15152?
CVE-2026-15152 is a medium-severity vulnerability in Unknown WP Hotel Booking, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
Weakness: CWE-345
Which versions are affected by CVE-2026-15152?
How do I fix CVE-2026-15152?
No fix has been published for CVE-2026-15152 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-15152 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15152 exists.
Sources
Also known as GHSA-gr3g-w52p-ff6r.