CVE-2026-8684
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The MotoPress Hotel Booking plugin for WordPress up to version 6.0.1 is vulnerable to authorization bypass. Unauthenticated attackers can overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce is output in the HTML source of every public page, so any visitor can obtain a valid nonce and perform the action without an account.
Risk Assessment
An unauthenticated attacker can modify or delete internal booking notes, potentially leading to data integrity and confidentiality breaches.
Recommendation
Update the MotoPress Hotel Booking plugin to a version above 6.0.1 that includes the fix.
Other vulnerabilities in MotoPress Hotel Booking
See all- CVE-2026-15238Medium
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
- CVE-2026-15237Medium
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
Original NVD description (English source)
The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce for this action is output in the HTML source of every public page through wp_localize_script (MPHB._data.nonces), so any unauthenticated visitor can obtain a valid nonce and perform the action without any account or prior interaction.