EUVD-2026-50991
GHSA-pq8m-m5fw-95mh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L reflects the Subscriber-level authentication requirement; C:L is appropriate as PII is disclosed but no credential or system-level secrets are exposed; I and A are N as the flaw is read-only with no write or denial-of-service capability.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.
AnalysisAI
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.
Technical ContextAI
The affected component is a WordPress AJAX action registered by the MotoPress Hotel Booking plugin (CPE: cpe:2.3:a:unknown:motopress_hotel_booking:*:*:*:*:*:*:*:*), a commercial hospitality booking solution. WordPress AJAX handlers are invoked via wp-admin/admin-ajax.php and are accessible to any logged-in user unless the plugin explicitly enforces role or capability checks. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the plugin returns the full booking record - including PII - without first calling current_user_can() or an equivalent capability gate to confirm the requester is permitted to access that booking. Any WordPress account at the Subscriber tier or above (the lowest authenticated role) can call this action with an arbitrary booking identifier and receive the victim's personal data.
RemediationAI
Update the MotoPress Hotel Booking plugin to version 6.0.4 or later, which introduces the missing capability check in the affected AJAX action. The patch is available through the WordPress plugin repository and the vendor directly; refer to the WPScan advisory at https://wpscan.com/vulnerability/c441d996-e21f-4a16-8dcc-0b0ed61aec76/ for confirmation. If immediate patching is not feasible, a compensating control is to restrict WordPress registration so that no untrusted users can obtain even Subscriber-level accounts; this eliminates the authenticated prerequisite but may impact intended site functionality. Site owners using a web application firewall (WAF) such as Wordfence or Sucuri can attempt to block AJAX requests to the specific vulnerable action name - though this requires identifying the action hook from the POC details and carries a risk of breaking legitimate plugin functionality if misconfigured.
More in Motopress Hotel Booking
View allMotoPress Hotel Booking WordPress plugin versions before 6.2.3 permits any authenticated subscriber-level user to modify
Unauthorized payment record creation in MotoPress Hotel Booking WordPress plugin before 6.2.3 enables unauthenticated re
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant p
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today