EUVD-2026-55016
GHSA-2r7r-792g-6mpg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible via WordPress HTTP endpoints; subscriber account required (PR:L); IDOR yields bounded cross-customer read/write with no scope change or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
AnalysisAI
MotoPress Hotel Booking WordPress plugin versions before 6.2.3 permits any authenticated subscriber-level user to modify or overwrite the personal data of arbitrary customers by supplying a chosen record identifier, with no server-side ownership verification in place. The flaw affects WordPress hospitality sites running the plugin in its standard configuration and can be triggered by any user who holds even the lowest WordPress account role - a realistic threat on sites with open guest registration. A publicly available proof-of-concept exists per WPScan, though EPSS data (0.14%, 4th percentile) indicates mass automated exploitation has not materialized; upgrading to version 6.2.3 is the confirmed fix.
Technical ContextAI
MotoPress Hotel Booking is a commercial WordPress plugin built for accommodation and hospitality businesses to manage reservations and associated customer profiles. The vulnerability class is CWE-639 (Authorization Through User-Controlled Key), an Insecure Direct Object Reference (IDOR) pattern in which the application uses an attacker-supplied identifier to locate a data record and applies updates to it without verifying whether the authenticated user owns or is otherwise authorized to act on that record. The CPE string (cpe:2.3:a:unknown:motopress_hotel_booking:*:*:*:*:*:*:*:*) identifies the affected software; the 'unknown' vendor field reflects NVD's cataloguing gap for smaller WordPress plugin publishers rather than any ambiguity in product identity. The root cause lies in the plugin's customer record update handler, which trusts the caller-supplied record ID and processes the update unconditionally, bypassing WordPress's capability or ownership checks that should restrict cross-account operations.
RemediationAI
Update the MotoPress Hotel Booking plugin to version 6.2.3 or later immediately; this is the vendor-confirmed fix as documented in the WPScan advisory at https://wpscan.com/vulnerability/7283a28a-7241-4b9e-8fc5-5b427191c80e/. If patching cannot be applied immediately, a targeted compensating control is to disable WordPress user registration (Settings > General > 'Anyone can register' unchecked), which eliminates the ability for external attackers to self-provision subscriber accounts - note that this will also prevent legitimate guest account creation and may disrupt booking workflows that rely on front-end registration. Existing low-privileged user accounts should be audited and any accounts not associated with known staff or trusted guests should be deactivated while the patch is pending. Site administrators should also review recent customer record update activity in the booking database for anomalous cross-account modifications as an indicator of prior exploitation. No workaround fully replaces the patch.
More in Motopress Hotel Booking
View allUnauthorized payment record creation in MotoPress Hotel Booking WordPress plugin before 6.2.3 enables unauthenticated re
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated sub
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant p
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today