CyberRota Analysis
AI-GeneratedThe WP Hotel Booking plugin for WordPress prior to version 2.3.2 is vulnerable due to a lack of verification for payment notifications, enabling unauthenticated users to falsely mark their bookings as fully paid. This could lead to financial losses for site owners as payments may not actually be received. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.