Executive brief
MotoPress Appointment Booking is a WordPress plugin for managing appointment reservations and payments. An unauthenticated attacker can permanently delete any user's reservations by exploiting an authorization flaw in the booking endpoints, disrupting legitimate customer bookings and damaging business operations.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability in the REST API endpoints /motopress/appointment/v1/bookings/draft and /motopress/appointment/v1/payments/prepare. The plugin fails to validate booking ownership when processing booking identifiers on unauthenticated endpoints. An attacker can harvest a valid nonce from the public booking form page, adopt a victim's draft booking without authorization, and replay the nonce token against the payment-preparation endpoint with an empty item list to trigger hard deletion of all reservations. The vulnerability is reachable on sites configured with "Upon payment" confirmation mode and requires no user interaction or authentication. Affected versions are 2.4.7 and earlier; patched in 2.4.8.
Affected products
- MotoPress Appointment Booking before 2.4.8
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 2.4.8