EUVD-2026-69868
GHSA-gjgj-4946-rqm5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Permanent deletion of bookings impacts both data integrity and data availability; otherwise the input vector metrics are accurate for a fully unauthenticated network IDOR.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
AnalysisAI
Unauthenticated IDOR (CWE-639) in the MotoPress Appointment Booking WordPress plugin before version 2.4.8 enables any remote attacker to permanently delete arbitrary users' reservations by supplying a known booking identifier to an unprotected deletion endpoint. This CVE documents an incomplete fix of CVE-2026-9180 - the vulnerable deletion path remains reachable on sites using payment confirmation workflows, confirmed through version 2.4.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must be running MotoPress Appointment Booking before version 2.4.8 with the payment confirmation feature explicitly enabled - the CVE description identifies this as the specific unpatched code path remaining after the CVE-2026-9180 fix. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly identifies this as a network-accessible, zero-authentication flaw, but the moderate score understates real-world business impact for appointment-dependent organizations: silently wiping customer reservations causes material operational disruption even without data exfiltration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MotoPress Appointment Booking to version 2.4.8 or later immediately; this is the vendor-released patch addressing both CVE-2026-15232 and the prior incomplete remediation of CVE-2026-9180. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL Injection in the MotoPress Appointment Booking WordPress plugin (versions ≤ 2.4.5) allows authenticated attackers ho
Unauthenticated booking data tampering in MotoPress Appointment Booking for WordPress (all versions ≤ 2.4.4) allows remo
Share
External POC / Exploit Code
Leaving vuln.today