CVE-2026-15237

This CVE exposes a critical authorization gap in a WordPress booking plugin's REST API endpoint. The vulnerability allows unauthenticated attackers to create payment records with arbitrary status—including 'completed'—by specifying a booking ID and payment status in the request. The booking ID is a sequential integer, making enumeration trivial. The severity here isn't just the missing authorization check. It's the compound failure of three design choices: an unauthenticated REST endpoint, a payment state machine that trusts user-supplied status rather than requiring gateway-driven webhook confirmation, and sequential integer IDs that enable automated enumeration. An attacker can script this across an entire installation in minutes, creating fraudulent 'completed' payments for any existing booking. Those payments then cascade into downstream systems—check-in logic that trusts payment status, revenue dashboards aggregating fake income, access control granting room keys based on corrupted payment records. The root cause traces to a pattern common in WordPress plugin development: developers migrated from admin-ajax workflows to REST endpoints without recognizing that REST routes are globally exposed. The endpoint was likely intended for AJAX convenience within a controlled booking flow, with authorization assumed to happen downstream. That assumption rots when the original business logic refactors or migrates but the REST endpoint persists. For defenders: audit all REST endpoints in your WordPress plugins—registration alone makes them public API surface regardless of intended use. Check whether state machines accepting user input (payment status, order status, booking state) exist alongside REST endpoints that accept that input. Replace sequential IDs with UUIDs or salted hashes. The WordPress plugin ecosystem lacks强制 update mechanisms, so the disclosure-to-remediation window is measured in months—this isn't just a technical vulnerability, it's a temporal exposure window where automated exploitation can scale across millions of sites.

Reviewed through automated stages and approved by a human before publication.