What is the CVSS score of CVE-2026-15153?

CVE-2026-15153 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-15153?

Yes, a public proof-of-concept exploit is available for CVE-2026-15153. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-15153?

Yes, a patch is available for CVE-2026-15153. Update the affected software to the latest version immediately.

WP Hotel Booking CVE-2026-15153

EUVD-2026-50990 MEDIUM

SQL Injection (CWE-89)

2026-07-30 WPScan

GHSA-wfr8-jhhw-p824

WordPress SQLi Wp Hotel Booking Unknown

6.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

PR:H reflects mandatory booking-management role; S:C and C:H reflect SQL injection crossing plugin-table scope into broader WordPress DB; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:34 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

6.8 (MEDIUM)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 6.8

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.

AnalysisAI

SQL injection in the WP Hotel Booking WordPress plugin before 2.3.2 allows users holding plugin-specific booking-management roles to extract data from the underlying WordPress database via an unsanitized search parameter on the administrative booking listing page. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate the injected queries can reach data beyond the plugin's own tables, such as WordPress user credentials or site configuration. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV, suggesting targeted rather than widespread exploitation risk.

Technical ContextAI

The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Queries): the plugin directly concatenates a search parameter into a SQL query inside the admin booking listing interface without sanitizing or escaping user input, and without using WordPress's prepared statement API (wpdb->prepare). Affected product identified by CPE cpe:2.3:a:unknown:wp_hotel_booking:*:*:*:*:*:*:*:* - the vendor field is unresolved in NVD. The plugin manages hotel reservations within the WordPress ecosystem, and its booking-management role grants access to the vulnerable admin listing. The CVSS scope change (S:C) confirms the SQL context can cross plugin-table boundaries into broader WordPress database tables such as wp_users, wp_options, or custom data stores.

RemediationAI

Update the WP Hotel Booking plugin to version 2.3.2 or later via the WordPress admin dashboard (Plugins > Installed Plugins > Update); this is the vendor-released patch confirmed in the CVE description and WPScan advisory at https://wpscan.com/vulnerability/0f678ab4-ec62-48a9-88c8-def3228ff725/. Prior to patching, reduce exposure by auditing and minimizing which users hold the plugin's booking-management role, retaining only fully trusted personnel - this directly limits the exploitable attacker pool given PR:H. As an additional layer, deploy a WAF rule targeting SQL metacharacter injection in admin search parameters; note this may produce false positives on legitimate booking searches containing special characters such as apostrophes in guest names. Do not rely on WAF as a primary control.