What is GHSA-9rjp-x5g7-g983?

GHSA-9rjp-x5g7-g983 is a security advisory published by GitHub Security Advisories with Medium severity. The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the...

Which CVE IDs does GHSA-9rjp-x5g7-g983 cover?

GHSA-9rjp-x5g7-g983 covers the following CVE IDs: CVE-2026-15149. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9rjp-x5g7-g983?

GHSA-9rjp-x5g7-g983 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-9rjp-x5g7-g983MediumCVSS 5.3

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the...

Vendor

GitHub Security Advisories

Published

August 7, 2026

Last Modified

August 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-15149 →

📋 Description

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-15149
https://wpscan.com/vulnerability/9c1df017-dfa5-43c4-b31e-43c9315edab1
https://github.com/advisories/GHSA-9rjp-x5g7-g983