Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N L N 5.3 .0013 2.6 —
AFFECTED Product Versions Fixed WP Hotel Booking unspecified —
TIMELINE Jul 8 Reserved by WPScan Aug 6 Published (CNA: WPScan) Aug 7 EXPLOIT PUBLISHED — CVE-2026-15152 (Unknown WP Hotel Booking). Public exploit reference added.
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
| Date | Event | Detail |
|---|---|---|
| July 8, 2026 | Reserved | Reserved by WPScan |
| August 6, 2026 | Published | Published (CNA: WPScan) |
| August 7, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-15152 (Unknown WP Hotel Booking). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | WP Hotel Booking | — | — | — |
Authoritative record: CVE-2026-15152 at cve.org
Weaknesses: CWE-345
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-15152 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.