What makes this flaw dangerous is that it allows anyone on the network to send a request that pretends a payment has already been completed. The payment creation endpoint lacks any authentication or ownership checks, so a malicious actor can create a paid record for any booking ID they know, making the booking appear settled and potentially allowing the site owner to release the reservation prematurely or trigger other downstream processes that rely on paid status. The inherent weakness is an authorization bypass that elevates an unauthenticated user to the same level as a privileged operator for payment data.

The vulnerable code resides in the MotoPress Hotel Booking WordPress plugin, and every installation running a version earlier than 6.2.3 is exposed. Because the plugin is a WordPress add‑on, the flaw exists on any WordPress site that has not upgraded past the mentioned version, regardless of the underlying hosting environment.

An EPSS score of <1% indicates a low exploitation probability and the issue is not listed in CISA’s KEV catalog, but the lack of authentication grants immediate, low‑effort abuse. The CVSS score of 5.3 indicates moderate severity. An attacker only needs to know a valid booking identifier to create a fake paid record; no privileged credentials or local access are required. The attack vector is through the public REST API exposed by WordPress. Vendors have confirmed that patching to version 6.2.3 removes this weakness, but until that update is applied, the vulnerability represents a moderate risk function that can lead to financial loss and operational disruption.