https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T05:45:38.249161+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349277 EUVD-2026-349277 2026-10-09T05:45:38.251187+00:00 EUVD-2026-349277 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15152 fkie_cve-2026-15152 2026-10-09T05:45:38.251238+00:00

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.

 https://cve.radiocsirt.org/vuln/ghsa-gr3g-w52p-ff6r GHSA-gr3g-w52p-ff6r 2026-10-09T05:45:38.251275+00:00

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.