WP Hotel Booking CVE-2026-15153

Exploitation requires the attacker to hold the WP Hotel Booking plugin's booking-management role and authenticate to the WordPress admin panel - this is a plugin-specific elevated role distinct from standard WordPress subscriber or contributor roles, corresponding to PR:H in the CVSS vector. The plugin must be installed, active, and running a version prior to 2.3.2. The vulnerable entry point is the search parameter on the administrative booking listing interface, so access to the wp-admin area with this role is a hard prerequisite. Exploitation is limited by: (1) the requirement for an authenticated session with the booking-management role - unauthenticated and low-privilege WordPress users cannot trigger this; (2) the plugin must be actively deployed; (3) no availability or integrity impact is possible through this vector, only confidentiality.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N scores 6.8, placing this in the medium-high range. The high privilege requirement (PR:H) is the dominant risk-limiting factor: exploitation is constrained to users already holding a plugin-level booking-management role, substantially narrowing the attacker pool to insiders, compromised accounts, or privilege-escalation chains. EPSS at 0.18% (7th percentile) is consistent with no observed mass exploitation, and absence from CISA KEV confirms no confirmed active exploitation at time of analysis. However, a public POC via WPScan elevates targeted attack risk for hospitality-sector WordPress deployments. The S:C/C:H combination means a successful exploit yields meaningful data exfiltration beyond the plugin's own scope. Overall: real priority for hospitality sites with untrusted booking-management users or where account compromise is plausible; lower urgency for tightly access-controlled deployments where the role pool is fully trusted.

An attacker who has obtained booking-management role credentials - whether via phishing, credential stuffing, or insider access - logs into the WordPress admin panel and navigates to the booking listing page. They inject a SQL payload (e.g., a UNION-based or time-based blind injection) into the search field; with a publicly available POC from WPScan, this can be largely automated. The injected query crosses plugin-table scope boundaries to read the wp_users table or wp_options, enabling extraction of hashed passwords, API keys, or personal data of all site users.