# CVE-2026-9180: MotoPress Appointment Booking authorization bypass in BookingsRestController

Source: https://junglewise.ai/threats/cve-2026-9180-motopress-appointment-booking-authorization-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-9180 · Severity: medium · CVSS 5.3 · Published 2026-07-03

The MotoPress Appointment Booking plugin for WordPress, which manages service reservations and customer schedules, contains a security flaw that allows unauthorized individuals to modify existing booking records. An attacker can change the customer name, email address, and phone number associated with pending or unconfirmed appointments. This could lead to data corruption, loss of customer contact information, and disruption of business operations.

Technologies: [MotoPress Appointment Booking](https://junglewise.ai/threats/technologies/appointment-booking). Vendors: [MotoPress](https://junglewise.ai/threats/vendors/motopress).

## Quick answers

**Is CVE-2026-9180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9180 being exploited in the wild.

**How severe is CVE-2026-9180?** Medium severity, with a CVSS score of 5.3, published 3 July 2026.

**Which products and versions are affected?** MotoPress Appointment Booking up to, including 2.4.4.

**Is there a fix for CVE-2026-9180?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9180 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9180?** Check whether you run MotoPress Appointment Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key (CWE-639) in versions up to 2.4.4. The `POST /motopress/appointment/v1/bookings` REST endpoint uses a `permission_callback` that returns true for all users, and the `createBooking` handler in `BookingsRestController.php` fails to validate ownership of the `payment_details.booking_id` parameter. By submitting a request with no reservation items but a specific booking ID, an unauthenticated attacker can trigger `BookingService::createBooking()` to overwrite the customer name, email, and phone number of any booking not yet in a 'confirmed' status. Target booking IDs can be discovered via the publicly accessible `GET /motopress/appointment/v1/bookings/reservations` endpoint. A patch appears to be available in the plugin's trunk repository.

## Affected products

- jetmonsters MotoPress Appointment Booking up to, including 2.4.4

## Timeline

- 2026-07-03: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php](https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php)
- [https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php](https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php)
- [https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php](https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php)
- [https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/services/BookingService.php](https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.3/includes/services/BookingService.php)
- [https://plugins.trac.wordpress.org/changeset/3583168/motopress-appointment-lite/trunk/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php](https://plugins.trac.wordpress.org/changeset/3583168/motopress-appointment-lite/trunk/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a6521d-39b2-48f4-834b-888047619df5?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a6521d-39b2-48f4-834b-888047619df5?source=cve)