MotoPress Appointment Booking vulnerabilities

The MotoPress Appointment Booking WordPress plugin before version 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.

The MotoPress Appointment Booking plugin for WordPress up to version 2.4.4 contains an authorization bypass vulnerability via user-controlled key. Unauthenticated attackers can overwrite customer data (name, email, phone, customer_id) in unconfirmed victim bookings by exploiting a publicly accessible REST endpoint.

The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL injection via the 's' parameter in all versions up to and including 2.4.5 due to insufficient escaping and lack of query preparation. This allows authenticated attackers with custom-level access or higher to append additional SQL queries to existing ones.