EUVD-2026-54188
GHSA-gr3g-w52p-ff6r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (wpscan) · only source for this CVE.
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
AnalysisAI
Payment notification forgery in WP Hotel Booking WordPress plugin before 2.3.2 allows unauthenticated remote users to obtain confirmed hotel bookings without submitting any real payment. The plugin fails to validate two critical conditions when processing inbound payment notifications: that the notification originates from the site's own merchant account, and that the reported payment amount matches the actual booking total. An attacker can exploit this by submitting a crafted payment callback (e.g., a fake IPN-style webhook) to have any booking marked as fully paid. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
WP Hotel Booking is a WordPress plugin designed for hospitality businesses to manage reservations and accept online payments. Payment gateway integrations - particularly those relying on asynchronous payment notification protocols such as PayPal IPN (Instant Payment Notification) or similar webhook-driven callbacks - typically send a POST request to a plugin endpoint after a transaction completes. The plugin must verify the notification's authenticity (merchant account identity) and data integrity (amount matches booking) before updating booking status. Failing to perform these checks is a classic business-logic flaw related to insufficient verification of data authenticity. While no CWE is formally assigned, this maps to CWE-345 (Insufficient Verification of Data Authenticity) and CWE-840 (Business Logic Errors). The affected version range is WP Hotel Booking < 2.3.2, as confirmed by WPScan and the ENISA EUVD entry EUVD-2026-54188.
RemediationAI
Update WP Hotel Booking to version 2.3.2 or later, which is confirmed as the patched release per vendor advisory. Plugin updates are available through the standard WordPress admin dashboard under Plugins > Updates, or by downloading directly from the WordPress plugin repository. No specific workarounds are documented in the available references; however, site operators who cannot update immediately should consider temporarily disabling the payment notification endpoint or restricting access to it by IP (to known payment gateway IP ranges only) via the web server or WAF configuration - note that IP-restricting a payment callback endpoint may prevent legitimate payment confirmations from processing, requiring manual order review during that period. The WPScan advisory at https://wpscan.com/vulnerability/e2435361-0a2a-4914-b4d8-7fb28386c4d3/ should be consulted for any additional guidance from the reporter.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today