Description

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:16.340Z",
  "pubdate": "2026-09-02T06:17:16.340Z",
  "executiveSummary": "The MotoPress Appointment Booking plugin for WordPress, in versions prior to 2.4.8, contains a critical Broken Access Control vulnerability. This flaw stems from an incomplete mitigation of CVE-2026-9180, where the system fails to verify user authorization or booking ownership when processing deletion requests on an unauthenticated endpoint.\nThe vulnerability allows unauthenticated remote attackers to permanently delete arbitrary reservations from the database. Because the check is missing, any external actor can supply a booking identifier to the vulnerable endpoint to trigger the removal process. This results in complete loss of booking data integrity and availability, potentially causing severe operational disruption for businesses relying on the platform for scheduling. The vulnerability remains exploitable in version 2.4.7, specifically on installations utilizing payment confirmation mechanisms.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the application's access control layer to enforce ownership validation on the API endpoint responsible for reservation management. Specifically, the MotoPress Appointment Booking plugin processes booking deletion requests without verifying the identity of the requester or confirming that the requester possesses the necessary permissions to modify the targeted resource. This represents a logic flaw where an unauthenticated endpoint blindly trusts the provided booking identifier.\nThe attack flow begins when an unauthenticated attacker identifies a valid booking identifier, which may be discoverable through enumeration or exposure in public-facing booking confirmations. The attacker sends a crafted request targeting the unauthenticated endpoint responsible for deletion. Upon receiving this request, the application backend initiates the deletion routine without performing a session check or an authorization verification step.\nThis vulnerability is an incomplete remediation of CVE-2026-9180. While developers attempted to secure the endpoint, the patch failed to cover scenarios involving sites configured for payment confirmation. In version 2.4.7, the logic branch that handles confirmed bookings fails to implement the necessary security middleware, leaving the resource exposed to unauthorized manipulation.\nFrom a post-exploitation perspective, the impact is severe. The attacker can systematically iterate through booking identifiers to purge the entire reservation database, causing a denial-of-service condition for the booking system. Because the operation is permanent, there is no built-in mechanism for users to recover the deleted reservations without manual database restoration from backups. The exploit requires no authentication or special privileges, making it accessible from any network location with access to the WordPress site's public-facing interfaces."
}