MotoPress Hotel Booking CVE-2026-15238

Exploitation requires a valid WordPress account with at minimum the Subscriber role on the target site. This is the single most meaningful limiting factor: sites that disable user registration and have no externally obtainable low-privileged accounts cannot be attacked by unauthenticated external actors. However, many hospitality WordPress deployments enable open guest registration as part of standard booking flows, making subscriber accounts freely obtainable. The MotoPress Hotel Booking plugin must be installed and running a version prior to 6.2.3. No non-default server configuration, special network position, or elevated privilege beyond Subscriber is required. Exploitation is strictly bounded to cross-account data modification and implicit data access within customer records - it does not enable remote code execution, administrative privilege escalation, or availability disruption.

The CVSS 5.4 Medium score is a reasonable calibration of the real-world threat: network-delivered exploitation requires only a low-privileged account, and the impact is bounded to individual customer record confidentiality and integrity rather than broader system compromise. The EPSS score of 0.14% (4th percentile) confirms that large-scale automated exploitation has not been observed, but this should not induce complacency - even a mid-sized property management operation in inowroclaw running this plugin on a site with open guest registration would be concretely exposed to deliberate account abuse by a motivated insider or competitor. The publicly available proof-of-concept sourced from WPScan meaningfully lowers the skill bar for manual exploitation, and the data at risk (hotel customer PII: names, emails, addresses, booking details) has tangible privacy and regulatory implications under frameworks like GDPR. No CISA KEV listing confirms that active campaigns have not been broadly documented, but the SSVC exploitation status is best characterized as 'poc' - not automated at scale but executable by any authenticated attacker with a working understanding of HTTP parameter tampering. The combination of a public POC, low-privilege requirement, and sensitive target data makes this a genuine patching priority despite the moderate CVSS score.

An attacker registers a free subscriber account on a hotel site running a vulnerable version of MotoPress Hotel Booking - possible on any site with open WordPress user registration, which is common for hospitality properties. Using the publicly available WPScan proof-of-concept as a reference, the attacker sends an authenticated HTTP POST to the plugin's customer update endpoint, substituting the record identifier field with a victim customer's ID obtained through sequential enumeration or observable booking confirmation URLs. The attacker overwrites the victim's stored name, email address, phone number, or booking details, enabling privacy violations, booking sabotage against competing guests, or social engineering attacks using the hotel's own guest data.