Unknown Motopress Hotel Booking vulnerabilities

3 CVEs affecting Unknown Motopress Hotel Booking, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15238, published 2026-08-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15237, published 2026-08-10. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to…
CVE-2026-15235, published 2026-07-30. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated…
CVE-2026-15238, published 2026-08-10. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber…