Executive brief
The MotoPress Hotel Booking plugin for WordPress, which manages reservations and customer information, contains a security flaw that exposes sensitive guest data. Any logged-in user, even those with the lowest level of access like a subscriber, can view the full personal details of any customer who has made a booking. This includes names, email addresses, phone numbers, and physical addresses, potentially leading to privacy violations and identity theft risks.
Technical details
The MotoPress Hotel Booking (and Hotel Booking Lite) plugin fails to implement proper authorization checks in the 'mphb_get_admin_calendar_booking_info' AJAX action. While the action requires a valid nonce, the plugin localizes this nonce for all logged-in users, including those with Subscriber-level privileges. An attacker can retrieve this nonce and then send a POST request to admin-ajax.php, iterating through 'booking_id' parameters to extract PII such as name, email, phone, and address from the JSON response. The vulnerability is classified as an Improper Authorization leading to Sensitive Data Exposure (CWE-200). The issue is resolved in version 6.0.4.
Affected products
- MotoPress Hotel Booking Lite < 6.0.4
Timeline
- 2026-07-09: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD publication date
- 2026-07-09: patched: Fixed in version 6.0.4