MotoPress Appointment Booking CVE-2026-13454

Exploitation requires a valid WordPress account with the mpa_appointment_employee custom role assigned - this role is specific to the MotoPress Appointment Booking plugin and is not present in default WordPress installations; it must be explicitly granted by a site administrator. The mpa_appointment_employee role, or any higher-privileged role, enables access to the ManageBookingsPage.php admin interface where the vulnerable 's' search parameter is processed. Limiting factors: (1) the attacker must be authenticated - unauthenticated exploitation is ruled out by PR:L in the CVSS vector; (2) the plugin must be installed and active; (3) the administrator must have created and assigned the mpa_appointment_employee role; (4) the impact is limited to data exfiltration (C:H) with no write or availability impact confirmed from the description.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly captures a high-confidentiality, network-exploitable flaw requiring low privilege. The critical limiting factor is the PR:L requirement tied specifically to the mpa_appointment_employee custom role - a non-default role that must be explicitly assigned by a WordPress administrator, substantially narrowing the exploitable population. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. KEV status is absent, meaning CISA has not confirmed active exploitation. No public proof-of-concept code was identified in the provided intelligence. In practice, this vulnerability poses elevated risk in multi-tenant WordPress environments (e.g., managed booking platforms) where employees are routinely granted the mpa_appointment_employee role, but presents limited risk in single-operator deployments where the role is rarely assigned.

An attacker who has been legitimately assigned - or has compromised credentials for - the mpa_appointment_employee role logs into the WordPress admin panel, navigates to the booking management page, and submits a crafted search string in the 's' parameter (e.g., appending UNION SELECT statements) to retrieve WordPress user password hashes, email addresses, or other sensitive data from the database. The attack requires no special tooling beyond a web browser or curl, as the injection point is a standard HTTP GET or POST parameter in a predictable admin endpoint.