PT-2026-55499 · Jetmonsters · Motopress Appointment Booking
G0Wthr
·
Published
2026-07-03
·
Updated
2026-07-03
·
CVE-2026-9180
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the
POST /motopress/appointment/v1/bookings REST endpoint being registered with 'permission callback' => ' return true', allowing unauthenticated access, while the createBooking handler in BookingsRestController.php accepts an attacker-supplied payment details.booking id value and loads the referenced booking via findById() without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and customer id of any non-confirmed victim booking by submitting a request with no reservation items, causing BookingService::createBooking() to load the existing victim booking object and persist it with attacker-controlled customer data. Victim booking IDs can be harvested prior to exploitation without authentication by querying the also-publicly-accessible GET /motopress/appointment/v1/bookings/reservations endpoint with a guessable service id and date range, and only bookings whose status is not STATUS CONFIRMED (e.g., pending or auto-draft) are valid targets.Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Motopress Appointment Booking