The flaw is a missing authorization check that allows an unauthenticated visitor to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking in MotoPress Hotel Booking. The vulnerability arises because the plugin exposes a nonce for the mphb_update_booking_notes AJAX action on every public page, so any user can acquire a valid nonce and submit the request without being logged in. An attacker could therefore alter booking data, potentially causing incorrect billing, reservation misuse, or loss of confidence in the booking system.

All installations of the MotoPress Hotel Booking plugin for WordPress with a version number 6.0.1 or earlier are affected. This includes the free Lite version and the full version from the Jetmonsters vendor. Any WordPress site that has the plugin active before version 6.0.2 is vulnerable.

The CVSS score of 5.3 indicates a medium severity flaw that does not grant code execution but allows unauthorized modification of booking information. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalogue, it is likely not actively exploited in the wild, yet the attack path is trivial: an unauthenticated web visitor can obtain a page‑generated nonce and invoke the AJAX endpoint directly. This makes the vulnerability high‑risk for sites that rely on booking data integrity.