CVE-2026-15149

Name of the Vulnerable Software and Affected Versions WP Hotel Booking versions prior to 2.3.3

Description Unauthenticated users can manipulate the total price of a booking by submitting non-positive values for the qty parameter to the public REST API endpoint. This occurs because the software relies on client-controlled cart data and lacks server-side validation to ensure that room quantities and the resulting order total are non-negative, allowing reservations to be confirmed for free or at an arbitrarily reduced price.

Recommendations Update to version 2.3.3 or later. Restrict access to the qty parameter in the public REST API endpoint to prevent the submission of non-positive values.