The MotoPress Appointment Booking plugin for WordPress contains an authorization bypass that allows any unauthenticated user to overwrite the customer name, email address, phone number, and customer identifier of any booking that has not yet been confirmed. The flaw is caused by a REST endpoint registered with a permission callback that always returns true and a handler that accepts a user-supplied booking ID without checking ownership. This is an example of CWE‑639 – Insecure Direct Object Reference. The result is that attacker‑controlled data can replace legitimate booking information, corrupting the booking record.

Jetmonsters’ MotoPress Appointment Booking plugin for WordPress versions 2.4.4 and earlier is vulnerable. Any WordPress site running those versions exposes the public REST endpoint /motopress/appointment/v1/bookings, which can be abused to modify booking data without authentication.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of <1% shows that exploitation attempts are currently rare but possible. Attackers do not need any credentials; they can send an unauthenticated POST request to /motopress/appointment/v1/bookings with a guessed booking_id of a non‑confirmed reservation. Booking IDs can be harvested through the publicly exposed GET /motopress/appointment/v1/bookings/reservations endpoint using a guessable service identifier and date range. Because the vulnerability is exposed to the public internet and requires only a valid booking ID, the attack vector is unauthenticated network access. The vulnerability is not listed in the CISA KEV catalog, but the lack of authorization checks makes it a low‑effort exploit that could be used to tamper with booking data.