MotoPress Appointment Booking CVE-2026-15232

The target WordPress site must be running MotoPress Appointment Booking before version 2.4.8 with the payment confirmation feature explicitly enabled - the CVE description identifies this as the specific unpatched code path remaining after the CVE-2026-9180 fix. No authentication credentials or session tokens are required; the vulnerable endpoint is fully unauthenticated (CVSS PR:N confirmed). The attacker must know or be able to enumerate valid booking identifiers; if IDs are sequential integers this is trivial, and if they are GUIDs the effort increases substantially. Sites with payment confirmation disabled are likely not reachable via this specific code path, but upgrading to 2.4.8 is recommended regardless. No specific platform, hosting configuration, or additional plugin is required beyond the vulnerable plugin version and the payment confirmation setting.

The CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly identifies this as a network-accessible, zero-authentication flaw, but the moderate score understates real-world business impact for appointment-dependent organizations: silently wiping customer reservations causes material operational disruption even without data exfiltration. The incomplete-fix history - a prior remediation of CVE-2026-9180 that failed to close this code path - modestly reduces confidence that the authorization model was comprehensively audited, though version 2.4.8 is the current vendor-confirmed fix. The publicly available WPScan proof-of-concept significantly lowers exploitation effort; the attack is fully automatable (no authentication, no user interaction, low complexity), raising the practical risk above what the CVSS numeric score implies. No CISA KEV listing or EPSS score was provided; widespread automated scanning cannot be confirmed but cannot be ruled out given the trivial attack profile. Sites not using payment confirmation may not be affected by this specific code path but should upgrade regardless.

An attacker targets a WordPress site running MotoPress Appointment Booking before 2.4.8 with payment confirmation enabled, and submits unauthenticated HTTP requests to the booking deletion endpoint iterating over sequential or otherwise guessable booking identifiers. Since no authentication or ownership verification occurs, each valid booking ID results in permanent deletion of that customer's reservation. A publicly available proof-of-concept from WPScan enables this attack with minimal skill, and the operation is easily scriptable for bulk deletion.