The MotoPress Hotel Booking WordPress plugin fails to verify that a user owns the customer record before updating it. Any authenticated user with a Subscriber role or higher can supply an arbitrary customer identifier and overwrite the data for that customer, enabling data tampering and privacy violations. This is a classic Insecure Direct Object Reference flaw that allows an attacker to modify personal information and potentially impersonate customers or change booking details.

The vulnerability exists in versions of the MotoPress Hotel Booking plugin earlier than 6.2.3. Users of the WordPress plugin falling within this version range are affected if they have any level of authenticated access beyond the guest role.

The edit operation relies solely on authentication and not on ownership checks, which means any authenticated user can exploit the flaw. The attack vector is therefore limited to accounts already logged in through WordPress. No CVSS score or EPSS value is available for this issue, and it is not listed in the CISA KEV catalog, but the lack of authorization checks makes the risk high. An attacker could create and propagate false or incorrect customer records, leading to data integrity issues and potential legal or financial consequences.