CVE-2026-15232
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The MotoPress Appointment Booking WordPress plugin before version 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
Risk Assessment
The risk is the ability for unauthenticated attackers to permanently delete other users' reservations, potentially causing disruption and data loss.
Recommendation
Update the MotoPress Appointment Booking plugin to version 2.4.8 or later, which includes the complete fix.
Other vulnerabilities in MotoPress Appointment Booking
See all- CVE-2026-9180Medium
The MotoPress Appointment Booking plugin for WordPress up to version 2.4.4 contains an authorization bypass vulnerability via user-controlled key. Unauthenticated attackers can overwrite customer data (name, email, phone, customer_id) in unconfirmed victim bookings by exploiting a publicly accessible REST endpoint.
- CVE-2026-13454Medium
The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL injection via the 's' parameter in all versions up to and including 2.4.5 due to insufficient escaping and lack of query preparation. This allows authenticated attackers with custom-level access or higher to append additional SQL queries to existing ones.
Original NVD description (English source)
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS