WP Hotel Booking accepts unbound payment notifications before 2.3.2
WP Hotel Booking before 2.3.2 can mark a booking fully paid after receiving a payment notification without confirming that the payment went to the site's configured merchant account or that its amount matches the booking total. An unauthenticated attacker can present a notification for a payment that does not compensate the site owner and obtain paid-booking status. The payment provider, notification endpoint or action, request parameters, handler function and merchant and amount fields are not disclosed.
- Component
- WP Hotel Booking
- Plugin slug
wp-hotel-booking- Affected
- < 2.3.2
- Safe version
2.3.2- Published
- Aug 06, 2026
This CVE was published Aug 06, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
Update WP Hotel Booking to 2.3.3 or later, which also fixes CVE-2026-15149. Reconcile paid bookings against the processor's merchant and amount records.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N