CVE-2026-15235

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking versions prior to 6.0.4

Description The plugin fails to perform a capability check before returning full customer details during an AJAX action. This allows any authenticated user with low-privileged access, such as a Subscriber account, to read personal data of customers, including name, email, phone, and address.

Recommendations Update to version 6.0.4 or later.