MotoPress Hotel Booking EUVD-2026-50991

Exploitation requires an authenticated WordPress session at the Subscriber role or higher - the lowest non-anonymous role in a standard WordPress installation. The attacker must be able to create or obtain such an account on the target site; many hotel and hospitality WordPress sites permit guest self-registration, making this prerequisite easy to satisfy. The MotoPress Hotel Booking plugin must be installed, active, and have at least one customer booking in the database for the information disclosure to yield useful data. The vulnerable endpoint is the plugin's AJAX action handler, reachable over the network via the standard WordPress AJAX URL. Exploitation is limited to read-only PII disclosure - there is no integrity or availability impact. Sites that disable open user registration without a corresponding plugin capability check remediation remain vulnerable to insider threats from existing low-privilege accounts.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is broadly consistent with the threat model: network-reachable, low complexity, low privilege required, confidentiality impact only. EPSS at 0.16% (5th percentile) reflects limited automated exploitation activity, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation campaigns at time of analysis. However, a public proof-of-concept exploit is available via WPScan, which meaningfully lowers the barrier for opportunistic attackers. For hospitality businesses, the practical impact exceeds what the CVSS C:L rating alone conveys - exposure of guest names, emails, phone numbers, and addresses constitutes a potential GDPR/privacy regulatory event, not merely a technical confidentiality degradation. Risk is therefore elevated relative to the numeric score for any site operating under data protection regulation.

An attacker registers or obtains a Subscriber-level WordPress account on a target hotel site running the vulnerable plugin - a common scenario given that many hospitality sites allow guest self-registration. The attacker then sends a crafted POST request to wp-admin/admin-ajax.php with the vulnerable action name and an enumerated or guessed booking ID. The plugin returns the full customer record for that booking without any authorization validation, exposing the victim guest's name, email address, phone number, and physical address. A public proof-of-concept is available through WPScan, making this attack accessible to low-skill threat actors.