PT-2026-42738 · WordPress · Motopress Hotel Booking

Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-8684

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking versions prior to 6.0.2

Description The MotoPress Hotel Booking plugin for WordPress contains an authorization bypass flaw resulting from improper verification of user permissions. Unauthenticated attackers can overwrite or delete internal notes by providing an arbitrary booking ID. This is possible because the required nonce is exposed in the HTML source of all public pages via wp localize script in the MPHB. data.nonces variable, allowing any visitor to perform the action without an account. The affected variable is mphb booking internal notes.

Recommendations Update to version 6.0.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-8684

Affected Products

Motopress Hotel Booking

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-8684 · Security Note
• https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/6.0.1/includes/ajax-api/ajax-api-handler.php#L43 · Note
• https://twitter.com/CVEnew/status/2057783164676751630 · Twitter Post
• https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/5.4.1/includes/ajax-api/ajax-actions/abstract-ajax-api-action.php#L34 · Note
• https://plugins.trac.wordpress.org/changeset/3537354/motopress-hotel-booking-lite/trunk/includes/ajax-api/ajax-actions/update-booking-notes.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6567e63c-3129-47b2-a734-733eb599821a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/6.0.1/includes/ajax-api/ajax-actions/abstract-ajax-api-action.php#L34 · Note
• https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/6.0.1/includes/ajax-api/ajax-actions/update-booking-notes.php#L83 · Note
• https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/5.4.1/includes/ajax-api/ajax-api-handler.php#L43 · Note
• https://plugins.trac.wordpress.org/browser/motopress-hotel-booking-lite/tags/5.4.1/includes/ajax-api/ajax-actions/update-booking-notes.php#L83 · Note