WordPress Hotel Booking Lite plugin < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint vulnerability

Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint vulnerability discovered by Haitam Lazaar in WordPress Plugin Hotel Booking Lite versions 6.2.3...

CVE-2026-15237 Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...