Junglewise Threat Intelligence

CVE-2026-8684: MotoPress Hotel Booking authorization bypass in booking notes update

CVE-2026-8684 · Severity: medium · CVSS 5.3 · Published 2026-05-22

Executive brief

The MotoPress Hotel Booking plugin for WordPress, which manages property reservations and guest information, contains a security flaw that allows unauthorized individuals to modify booking records. An attacker can overwrite or delete internal administrative notes associated with any guest booking. This could lead to the loss of important internal documentation and disrupt hotel management operations.

Technical details

The MotoPress Hotel Booking plugin for WordPress (up to version 6.0.1) fails to perform adequate authorization checks in its AJAX API handler for updating booking notes. Specifically, the 'update-booking-notes' action does not verify if the requester has administrative privileges. While the action is protected by a nonce, this nonce is leaked to all visitors via the 'MPHB._data.nonces' object in the HTML source of public pages. Consequently, an unauthenticated attacker can obtain a valid nonce and send a crafted request with an arbitrary booking ID to overwrite or delete the '_mphb_booking_internal_notes' meta field.

Affected products

  • MotoPress Hotel Booking Up to and including 6.0.1

Timeline

  • 2026-05-22: disclosed
  • 2026-05-22: advisory

References

Related threats