CVE-2026-15153

MediumCVSS 6.8

Published: 30/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitize and escape a search parameter on an admin page before using it in a SQL query. Users with booking-management roles can perform SQL injection attacks.

Risk Assessment

Attackers may gain unauthorized database access, steal or modify booking data.

Recommendation

Update the WP Hotel Booking plugin to version 2.3.2 or later.

Other vulnerabilities in WP Hotel Booking WordPress plugin

CVE-2026-9822Medium
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.

Original NVD description (English source)

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS