Executive brief
MotoPress Hotel Booking is a WordPress plugin that manages hotel bookings and payments. An attacker can exploit a missing authorization check in a REST API endpoint to create fake payment records for any booking without authentication, falsely marking arbitrary reservations as paid and potentially causing revenue loss or disrupting the booking workflow.
Technical details
The vulnerability is a broken access control issue (CWE-862) in the `/wp-json/mphb/v1/checkout/payments` REST endpoint. The endpoint creates payment records without verifying user authentication or ownership of the targeted booking. An attacker can craft an unauthenticated POST request specifying an arbitrary booking ID and payment details to create a "Completed" payment record that never actually occurred. The endpoint processes requests from any origin without authorization, allowing iteration over booking IDs to falsely mark multiple bookings as paid. This affects MotoPress Hotel Booking (motopress-hotel-booking-lite) versions before 6.2.3, which is fixed in 6.2.3.
Affected products
- MotoPress Hotel Booking Lite before 6.2.3
Timeline
- 2026-08-06: disclosed
- 2026-06-10: patched: Fix released in version 6.2.3