PT-2026-55499 · Jetmonsters · Motopress Appointment Booking
G0Wthr
·
Publicado
2026-07-03
·
Atualizado
2026-07-03
·
CVE-2026-9180
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the
POST /motopress/appointment/v1/bookings REST endpoint being registered with 'permission callback' => ' return true', allowing unauthenticated access, while the createBooking handler in BookingsRestController.php accepts an attacker-supplied payment details.booking id value and loads the referenced booking via findById() without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and customer id of any non-confirmed victim booking by submitting a request with no reservation items, causing BookingService::createBooking() to load the existing victim booking object and persist it with attacker-controlled customer data. Victim booking IDs can be harvested prior to exploitation without authentication by querying the also-publicly-accessible GET /motopress/appointment/v1/bookings/reservations endpoint with a guessable service id and date range, and only bookings whose status is not STATUS CONFIRMED (e.g., pending or auto-draft) are valid targets.Correção
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Motopress Appointment Booking