The MotoPress Hotel Booking WordPress plugin, in all versions prior to 6.0.4, fails to check user capabilities before executing an AJAX action that returns a booking’s full customer details. This flaw permits any authenticated user with a low‑privileged role, such as Subscriber, to read sensitive personal information—including name, email, phone number, and address—of any booking. The disclosed data can be used for phishing, identity theft, or other forms of exploitation, representing a clear confidentiality violation.

The vulnerability affects installations of the MotoPress Hotel Booking plugin on WordPress sites running any version earlier than 6.0.4. All users logged into WordPress who have at least Subscriber status (or higher) can trigger the AJAX request and retrieve the protected customer data. The issue is specific to the Admin Calendar AJAX endpoint exposed by the plugin.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests that, while exploitation is possible, it is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated but low‑privileged user exploiting the exposed AJAX action; no elevated privileges or external network exposure are needed beyond access to the website’s administrative interface.