What is the CVSS score of CVE-2026-9180?

CVE-2026-9180 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

MotoPress Appointment Booking CVE-2026-9180

EUVD-2026-41492 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-03 Wordfence

GHSA-796c-rm6v-rccx

PHP WordPress Authentication Bypass Wordpress Plugin Motopress Appointment Booking Jetmonsters

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated REST endpoint with trivially enumerable target IDs; integrity-only impact limited to non-confirmed booking metadata fields.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 05:48 vuln.today

CVE Published

Jul 03, 2026 - 04:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the POST /motopress/appointment/v1/bookings REST endpoint being registered with 'permission_callback' => '__return_true', allowing unauthenticated access, while the createBooking handler in BookingsRestController.php accepts an attacker-supplied payment_details.booking_id value and loads the referenced booking via findById() without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and customer_id of any non-confirmed victim booking by submitting a request with no reservation items, causing BookingService::createBooking() to load the existing victim booking object and persist it with attacker-controlled customer data. Victim booking IDs can be harvested prior to exploitation without authentication by querying the also-publicly-accessible GET /motopress/appointment/v1/bookings/reservations endpoint with a guessable service_id and date range, and only bookings whose status is not STATUS_CONFIRMED (e.g., pending or auto-draft) are valid targets.

AnalysisAI

Unauthenticated booking data tampering in MotoPress Appointment Booking for WordPress (all versions ≤ 2.4.4) allows remote attackers to overwrite the customer name, email, phone number, and customer_id of any victim booking that has not yet been confirmed. The REST endpoint POST /motopress/appointment/v1/bookings is registered with permission_callback set to '__return_true', bypassing all WordPress capability checks, and the createBooking handler blindly trusts an attacker-supplied payment_details.booking_id to load and persist an existing booking without any ownership verification (CWE-639). No public exploit code or CISA KEV listing is confirmed at time of analysis, but the attack is trivially executable by any unauthenticated network attacker given the also-public booking enumeration endpoint.

Technical ContextAI

The vulnerability resides in BookingsRestController.php within the motopress-appointment-lite WordPress plugin (vendor: jetmonsters, CPE cpe:2.3:a:jetmonsters:motopress_appointment_booking:*:*:*:*:*:*:*:*). WordPress REST API endpoints require a permission_callback to gate access; using the built-in helper '__return_true' unconditionally grants access to all requesters, authenticated or not (line 98 of BookingsRestController.php). The createBooking handler at line 308 calls BookingService::createBooking(), which invokes findById() with the caller-supplied booking_id from payment_details - a classic Insecure Direct Object Reference (IDOR) pattern classified under CWE-639 (Authorization Bypass Through User-Controlled Key). Separately, the GET /motopress/appointment/v1/bookings/reservations endpoint is also publicly accessible and returns booking IDs filterable by service_id and date range, enabling trivial pre-exploitation reconnaissance with no credentials. Only bookings in non-confirmed states (pending, auto-draft) are valid targets because BookingService::createBooking() processes them differently from STATUS_CONFIRMED records.

RemediationAI

An upstream fix has been committed to the plugin trunk at WordPress.org Trac changeset 3583168 (https://plugins.trac.wordpress.org/changeset/3583168/motopress-appointment-lite/trunk/includes/rest/controllers/motopress/appointment/v1/BookingsRestController.php); however, the exact released patched version number is not independently confirmed from the available data - update to the latest available version in the WordPress plugin repository and verify the changeset is included. As an immediate compensating control, site administrators can use a WordPress firewall plugin (e.g., Wordfence, WP Cerber) to block unauthenticated POST requests to the /wp-json/motopress/appointment/v1/bookings REST route; note this may break legitimate guest booking flows. Restricting the GET /motopress/appointment/v1/bookings/reservations endpoint to authenticated users removes the trivial booking-ID enumeration primitive and raises the practical attack bar, though it does not close the write vulnerability itself. Operators should also review pending and auto-draft bookings for unexpected customer data changes as an indicator of exploitation.