WP Hotel Booking CVE-2026-15464

Exploitation requires a WordPress account with contributor-level privileges or above on the target site - unauthenticated attackers cannot exploit this vulnerability. The attacker must be able to publish or save content containing the 'widget_search' shortcode with a crafted attribute value. Critically, the stored payload is written into a hidden HTML attribute and is only executable via browser access key behavior (the HTML accesskey attribute acting as a trigger); browsers that do not expose access key interactions as an XSS execution path will not run the payload, and this is not universal behavior across modern browsers. Sites that restrict contributor registration to verified users, or that disable shortcode use for contributor-level roles, are not practically exploitable. The non-default browser interaction requirement is the primary limiting factor beyond the authentication prerequisite.

The Wordfence-assigned CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) captures the cross-origin scope change correctly via S:C and the contributor-level auth requirement via PR:L, but two metric choices are debatable. First, UI:N does not fully account for the fact that a victim must browse to the injected page - stored XSS typically warrants UI:R. Second, AC:L understates the attack complexity: the description explicitly limits exploitation to browsers where access key interactions can serve as a payload trigger, a non-universal browser behavior that many assessors would score AC:H. Neither CISA KEV listing nor EPSS data were provided, and no public exploit code has been identified, all of which reduce real-world urgency below what a raw 6.4 implies. The principal threat is privilege escalation within WordPress - a rogue contributor injecting scripts that execute for visiting editors or administrators, potentially enabling session hijacking or admin-level takeover - but the access key dependency is a meaningful constraint against opportunistic mass exploitation.

An attacker with a contributor-level WordPress account crafts a post or page embedding the 'widget_search' shortcode with a malicious JavaScript payload in the shortcode attribute. Once published, when a site administrator or editor visits that page in a browser that processes HTML access keys as executable triggers, the hidden-attribute payload fires, potentially exfiltrating the victim's authentication cookies or performing privileged actions such as adding a new administrator account. No public proof-of-concept code has been identified, but the vulnerability details and source code references are publicly disclosed via Wordfence.