EUVD-2026-55017
GHSA-vqh4-pqm8-4r46
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible REST endpoint requires no authentication or preconditions; impact is limited to booking payment integrity with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
AnalysisAI
Unauthorized payment record creation in MotoPress Hotel Booking WordPress plugin before 6.2.3 enables unauthenticated remote attackers to forge completed payment entries against any booking - falsely confirming reservations as paid without executing a real financial transaction. The vulnerable REST endpoint performs no authorization or ownership validation, making any booking ID on an affected site a viable target. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (4th percentile), and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Technical ContextAI
The vulnerability is classified as CWE-862 (Missing Authorization), a failure to enforce access control before performing a sensitive operation. The MotoPress Hotel Booking plugin (CPE: cpe:2.3:a:unknown:motopress_hotel_booking:*:*:*:*:*:*:*:*) exposes a WordPress REST API endpoint for creating payment records. WordPress REST API is enabled by default in all modern WordPress installations and is publicly accessible without authentication. The flaw resides in the plugin's failure to check whether the requesting user owns or has permission to modify the target booking before writing a completed payment record to the database. This breaks the fundamental authorization model expected for financial state transitions - any unauthenticated HTTP client can manipulate payment status for any booking by reference.
RemediationAI
Update the MotoPress Hotel Booking WordPress plugin to version 6.2.3 or later, which introduces proper authorization and ownership checks on the payment creation REST endpoint, as confirmed by the WPScan advisory (https://wpscan.com/vulnerability/b312a323-808c-497f-b67e-3b0acfcb8932/). If immediate patching is not feasible, restrict unauthenticated access to the plugin's REST API namespace using a Web Application Firewall rule or a WordPress security plugin (such as Wordfence or iThemes Security) that can require authentication for specific REST routes - note this may break legitimate guest payment flows and should be tested carefully. As a post-incident measure, site administrators should audit existing booking records for payment entries that lack corresponding gateway transaction confirmations, which would indicate prior exploitation.
More in Motopress Hotel Booking
View allMotoPress Hotel Booking WordPress plugin versions before 6.2.3 permits any authenticated subscriber-level user to modify
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated sub
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant p
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today