EUVD-2026-31417
GHSA-x7jf-v64x-878j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVisit any public page on target WordPress site
-
DeliveryExtract nonce from MPHB._data.nonces in page HTML source
-
ExploitCraft POST request to admin-ajax.php with nonce and target booking ID
-
ExecutionAJAX handler validates nonce but skips authorization check
-
ImpactOverwrite or delete internal booking notes for targeted reservation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the plugin being installed and active on a WordPress site with at least one publicly accessible page - the nonce is output on every such page. CVSS PR:N confirms unauthenticated exploitation. The attacker needs only a valid booking ID to target, which may be guessable via sequential integers or observable through the booking confirmation flow. Limiting factors: the impact is confined to the _mphb_booking_internal_notes meta field - no guest-facing data, credentials, or site integrity can be modified through this specific action. Exploitation does not grant code execution, file write access, or privilege escalation. |
| Impact | CVSS 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects a low-complexity, unauthenticated network attack with limited integrity impact and no confidentiality or availability consequence. The I:L scope is narrow - only internal operator notes are writable, not reservation status, payment data, or guest PII. No EPSS score was provided in the available data, so exploitation probability cannot be quantified from that signal. No CISA KEV listing exists, and no public POC has been identified. However, the nonce-in-HTML mechanism reduces effective attack complexity to near zero for any visitor to the site: no tooling, authentication, or brute force is needed. The practical risk to hotel operators is operational - booking notes used to track special requests, payment issues, or internal flags could be silently wiped or poisoned. The CVSS score is appropriate but may understate operational impact for hospitality businesses that rely heavily on those notes. |
| Exploit ScenarioDerived | An attacker visits any public-facing page of a WordPress site running the vulnerable plugin, views the page source or intercepts the HTML response, and extracts the valid nonce from the MPHB._data.nonces JavaScript object injected by wp_localize_script. The attacker then sends a crafted POST request to wp-admin/admin-ajax.php with the extracted nonce and an arbitrary booking ID, causing the server to overwrite or delete the _mphb_booking_internal_notes field for that booking with no authentication required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 22, 2026
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated remote attackers to overwrite or delete internal booking notes for any reservation by supplying an arbitrary booking ID. The root cause is a nonce that is unconditionally output into every public page's HTML via wp_localize_script under MPHB._data.nonces, meaning any site visitor - without an account or any prior interaction - can obtain a valid nonce and invoke the update-booking-notes AJAX action against any booking. No public exploit code has been identified at time of analysis, but the trivially accessible nonce makes this effectively zero-friction to abuse.
RemediationAI
An upstream fix has been committed to the plugin trunk as WordPress trac changeset 3537354, modifying update-booking-notes.php to enforce authorization checks. However, the exact released plugin version containing this fix is not independently confirmed from available data - site administrators should check the WordPress plugin repository for a version newer than 6.0.1 and update immediately upon availability. As a compensating control until a patched release is confirmed, administrators can restrict access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) for unauthenticated users via WAF rules or server-level controls, accepting that this may break other public AJAX functionality. Alternatively, operators can deactivate the plugin's note-editing feature if not operationally required. Monitoring wp-admin/admin-ajax.php POST requests for the update-booking-notes action from unauthenticated sessions can serve as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the plugin's AJAX API layer, specifically in the update-booking-notes action (includes/ajax-api/ajax-actions/update-booking-notes.php) and its base class (abstract-ajax-api-action.php), orchestrated by ajax-api-handler.php. CWE-862 (Missing Authorization) describes the root cause: the handler validates nonce integrity but never checks whether the requesting user is authorized to modify the target booking. WordPress nonces are meant to prevent CSRF but not to gatekeep authorization - yet here the nonce (exposed globally via wp_localize_script) is the only gate. The affected meta field _mphb_booking_internal_notes stores operator-facing notes on hotel reservations. CPE cpe:2.3:a:jetmonsters:motopress_hotel_booking:*:*:*:*:*:*:*:* covers all versions through 6.0.1 of the JetMonsters-published plugin. Code is auditable at the WordPress plugin trac browser for both 5.4.1 and 6.0.1 tags.
Know when Motopress Hotel Booking gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce for this action is output in the HTML source of every public page through wp_localize_script (MPHB._data.nonces), so any unauthenticated visitor can obtain a valid nonce and perform the action without any account or prior interaction.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Motopress Hotel Booking
View allMotoPress Hotel Booking WordPress plugin versions before 6.2.3 permits any authenticated subscriber-level user to modify
Unauthorized payment record creation in MotoPress Hotel Booking WordPress plugin before 6.2.3 enables unauthenticated re
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated sub
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant p
Exploit-DB