CVE-2026-15238 is an IDOR in a WordPress hospitality plugin allowing any authenticated Subscriber to modify arbitrary customer records by supplying a customer identifier to a write endpoint that lacks ownership verification. The CVSS 5.4 rating fundamentally misrepresents the risk because it treats this as a data modification issue when the real exposure lives in what that modification enables in a hospitality context.
Hotel booking systems accumulate high-value personal data — physical addresses, phone numbers, identification details, stay histories — and feed those records into physical infrastructure: PMS integrations, room key provisioning, billing systems, and concierge workflows. A mutated address doesn't stay contained in the bookings table. It can propagate downstream and potentially grant an attacker access to a room key for room 412. That's lateral movement through data mutation, and no CVSS score captures it.
The critical unknown is whether the endpoint executes silently. If modifying a customer's record triggers no notification to the true account holder, you have no way to detect exploitation during the window between vulnerability introduction and patch application. That window matters: WordPress plugin telemetry across similar vulnerabilities shows months-long lags between patch release and widespread updates, and unlike RCE chains, there's often no traffic signature flagging abuse because the endpoint is legitimately accessible to authenticated users.
What you should do now: First, update to 6.2.3 immediately — that's the patched version. Second, audit your customer records for anomalies, not just for signs of past exploitation but because downstream systems may have already consumed corrupted data during the exposure window. The patch fixes the code; it doesn't automatically reconcile data across PMS integrations, billing systems, or key provisioning. Third, treat any WordPress Subscriber account as potentially adversarial — the plugin's threat model assumed honest guests, but Subscriber accounts are free and unverified. The architecture that enabled this flaw (authenticated means authorized for any record) is a known pattern in hospitality WordPress plugins, and this won't be the last CVE in this lineage.