MotoPress Appointment Booking CVE-2026-9180

Exploitation requires no authentication and no special attacker privileges - the REST endpoint is explicitly registered with permission_callback set to '__return_true', granting universal access. The attacker must be able to reach the WordPress REST API over the network (typically port 443/80). The target booking must exist in a non-confirmed state (STATUS_CONFIRMED bookings are not valid targets); pending and auto-draft bookings are vulnerable. Booking ID enumeration is a prerequisite but is itself unauthenticated and requires only a valid service_id, which may be guessable or visible on the public booking form. Exploitation is limited to overwriting customer metadata fields (name, email, phone, customer_id) - it does not grant the ability to confirm, cancel, or reschedule bookings, nor to access payment credentials. Sites with no pending/unconfirmed bookings present no valid attack surface at any given moment.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly reflects unauthenticated network exploitability with low attack complexity, but the Medium severity label may understate operational risk for appointment-dependent businesses. The integrity impact is rated Low because only customer metadata fields (name, email, phone, customer_id) are overwritten - not payment records or the booking status itself - yet for a scheduling business, corrupting pending bookings with false contact details causes direct service disruption and potential data accuracy issues. EPSS data was not provided in the source intelligence. No CISA KEV listing is present, and no confirmed POC is referenced, placing this in a lower-urgency tier for most organizations. However, the attack chain is fully self-contained: booking IDs are freely enumerable via the public reservation endpoint without any credential, and the write primitive requires no special tooling. The automatable nature of both the recon and exploit phases elevates real-world risk above what the score alone suggests. There is no conflicting signal between CVSS vector and description - network, unauthenticated, low-complexity access is accurately modeled.

An unauthenticated attacker queries GET /wp-json/motopress/appointment/v1/bookings/reservations with a guessed or known service_id and a broad date range, harvesting a list of booking IDs for pending or auto-draft appointments. The attacker then submits a POST /wp-json/motopress/appointment/v1/bookings request with no reservation items but with payment_details.booking_id set to a harvested ID and attacker-controlled customer name, email, and phone number; the server loads the victim booking object and persists it with the falsified contact details. No exploit code repository is confirmed at time of analysis, but the attack requires only standard HTTP tooling given the fully documented endpoint behavior.