Junglewise Threat Intelligence

CVE-2026-9180: MotoPress Appointment Booking authorization bypass in BookingsRestController

CVE-2026-9180 · Severity: medium · CVSS 5.3 · Published 2026-07-03

Technologies: MotoPress Appointment Booking. Vendors: MotoPress.

Executive brief

The MotoPress Appointment Booking plugin for WordPress, which manages service reservations and customer schedules, contains a security flaw that allows unauthorized individuals to modify existing booking records. An attacker can change the customer name, email address, and phone number associated with pending or unconfirmed appointments. This could lead to data corruption, loss of customer contact information, and disruption of business operations.

Technical details

The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key (CWE-639) in versions up to 2.4.4. The `POST /motopress/appointment/v1/bookings` REST endpoint uses a `permission_callback` that returns true for all users, and the `createBooking` handler in `BookingsRestController.php` fails to validate ownership of the `payment_details.booking_id` parameter. By submitting a request with no reservation items but a specific booking ID, an unauthenticated attacker can trigger `BookingService::createBooking()` to overwrite the customer name, email, and phone number of any booking not yet in a 'confirmed' status. Target booking IDs can be discovered via the publicly accessible `GET /motopress/appointment/v1/bookings/reservations` endpoint. A patch appears to be available in the plugin's trunk repository.

Affected products

  • jetmonsters MotoPress Appointment Booking up to, including 2.4.4

Timeline

  • 2026-07-03: advisory: NVD publication date

References