Description
The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the `POST /motopress/appointment/v1/bookings` REST endpoint being registered with `'permission_callback' => '__return_true'`, allowing unauthenticated access, while the `createBooking` handler in `BookingsRestController.php` accepts an attacker-supplied `payment_details.booking_id` value and loads the referenced booking via `findById()` without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and `customer_id` of any non-confirmed victim booking by submitting a request with no reservation items, causing `BookingService::createBooking()` to load the existing victim booking object and persist it with attacker-controlled customer data. Victim booking IDs can be harvested prior to exploitation without authentication by querying the also-publicly-accessible `GET /motopress/appointment/v1/bookings/reservations` endpoint with a guessable `service_id` and date range, and only bookings whose status is not `STATUS_CONFIRMED` (e.g., pending or auto-draft) are valid targets.
Published: 2026-07-03
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The MotoPress Appointment Booking plugin for WordPress contains an authorization bypass that allows anyone to overwrite the customer name, email, phone number, and customer identifier of any non-confirmed booking. The flaw stems from a REST endpoint that is publicly accessible and accepts a user‑supplied booking identifier without verifying ownership, an instance of CWE-639. The result is a violation of data integrity that could expose personal information and corrupt booking records.

Affected Systems

Jetmonsters’ MotoPress Appointment Booking for WordPress versions up to and including 2.4.4 is affected. Any installation of these versions exposes a REST API endpoint that can be abused to alter booking information without authentication.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score of <1% shows a very low but non‑zero likelihood of exploitation. The vulnerability can be triggeredmotopress/appointment/v1/bookings endpoint with a chosen booking ID. The attacker can harvest valid booking IDs for non‑confirmed reservations by querying the publicly accessible GET /motopress/appointment/v1/bookings/reservations endpoint, making the attack low‑effort once the target ID is known. The issue is not listed in the CISA KEV catalog, but the combination of public access and lack of permission checks warrants timely remediation.

Generated by OpenCVE AI on July 21, 2026 at 10:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest available MotoPress Appointment Booking plugin version, which should correct the unauthorized permission callback.
  • If an upgrade cannot be applied immediately, add a custom filter in your theme’s functions.php or a security plugin to enforce authentication for the /motopress/appointment/v1/bookings endpoint by restricting the permission_callback to a function that returns.
  • As a temporary measure, block unauthenticated POST requests to /motopress/appointment/v1/bookings via web server rules (e.g., .htaccess deny or nginx deny).

Generated by OpenCVE AI on July 21, 2026 at 10:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Description The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the `POST /motopress/appointment/v1/bookings` REST endpoint being registered with `'permission_callback' => '__return_true'`, allowing unauthenticated access, while the `createBooking` handler in `BookingsRestController.php` accepts an attacker-supplied `payment_details.booking_id` value and loads the referenced booking via `findById()` without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and `customer_id` of any non-confirmed victim booking by submitting a request with no reservation items, causing `BookingService::createBooking()` to load the existing victim booking object and persist it with attacker-controlled customer data. Victim booking IDs can be harvested prior to exploitation without authentication by querying the also-publicly-accessible `GET /motopress/appointment/v1/bookings/reservations` endpoint with a guessable `service_id` and date range, and only bookings whose status is not `STATUS_CONFIRMED` (e.g., pending or auto-draft) are valid targets.
Title MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-06T12:35:03.456Z

Reserved: 2026-05-21T14:47:44.596Z

Link: CVE-2026-9180

cve-icon Vulnrichment

Updated: 2026-07-06T12:34:58.538Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:30:04Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key