{"id":"CVE-2026-15235","aliases":["EUVD-2026-50991","GHSA-pq8m-m5fw-95mh"],"status":"published","title":"Hotel Booking Lite \u003c 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action","description":"The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00295,"percentile":0.22341,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-07-30T06:00:07Z","modified":"2026-07-30T21:32:50Z","products":[{"vendor":"jetmonsters","product":"motopress hotel booking"},{"vendor":"unknown","product":"motopress hotel booking"}],"references":[{"url":"https://wpscan.com/vulnerability/c441d996-e21f-4a16-8dcc-0b0ed61aec76/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15235"},{"url":"https://wpscan.com/vulnerability/c441d996-e21f-4a16-8dcc-0b0ed61aec76"},{"url":"https://github.com/advisories/GHSA-pq8m-m5fw-95mh"}],"sources":{"cve":[{"id":"CVE-2026-15235","title":"Hotel Booking Lite \u003c 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action","description":"The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.","status":"published","published":"2026-07-30T06:00:07.7Z","modified":"2026-07-30T18:25:44.439Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-50991","description":"The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.","status":"published","published":"2026-07-30T06:00:07Z","modified":"2026-07-30T18:25:44Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:27.634971Z"}],"ghsa":[{"id":"GHSA-pq8m-m5fw-95mh","title":"The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check...","description":"The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.","status":"published","published":"2026-07-30T06:32:36Z","modified":"2026-07-30T21:32:50Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:09:59.177116Z"}],"nvd":[{"id":"CVE-2026-15235","description":"The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.","status":"published","published":"2026-07-30T06:25:01.467Z","modified":"2026-07-30T19:17:08.273Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:33.955581Z"}]}}