Motopress Hotel Booking
Monthly
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
MotoPress Hotel Booking WordPress plugin versions before 6.2.3 permits any authenticated subscriber-level user to modify or overwrite the personal data of arbitrary customers by supplying a chosen record identifier, with no server-side ownership verification in place. The flaw affects WordPress hospitality sites running the plugin in its standard configuration and can be triggered by any user who holds even the lowest WordPress account role - a realistic threat on sites with open guest registration. A publicly available proof-of-concept exists per WPScan, though EPSS data (0.14%, 4th percentile) indicates mass automated exploitation has not materialized; upgrading to version 6.2.3 is the confirmed fix.
Unauthorized payment record creation in MotoPress Hotel Booking WordPress plugin before 6.2.3 enables unauthenticated remote attackers to forge completed payment entries against any booking - falsely confirming reservations as paid without executing a real financial transaction. The vulnerable REST endpoint performs no authorization or ownership validation, making any booking ID on an affected site a viable target. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (4th percentile), and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated remote attackers to overwrite or delete internal booking notes for any reservation by supplying an arbitrary booking ID. The root cause is a nonce that is unconditionally output into every public page's HTML via wp_localize_script under MPHB._data.nonces, meaning any site visitor - without an account or any prior interaction - can obtain a valid nonce and invoke the update-booking-notes AJAX action against any booking. No public exploit code has been identified at time of analysis, but the trivially accessible nonce makes this effectively zero-friction to abuse.
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
MotoPress Hotel Booking WordPress plugin versions before 6.2.3 permits any authenticated subscriber-level user to modify or overwrite the personal data of arbitrary customers by supplying a chosen record identifier, with no server-side ownership verification in place. The flaw affects WordPress hospitality sites running the plugin in its standard configuration and can be triggered by any user who holds even the lowest WordPress account role - a realistic threat on sites with open guest registration. A publicly available proof-of-concept exists per WPScan, though EPSS data (0.14%, 4th percentile) indicates mass automated exploitation has not materialized; upgrading to version 6.2.3 is the confirmed fix.
Unauthorized payment record creation in MotoPress Hotel Booking WordPress plugin before 6.2.3 enables unauthenticated remote attackers to forge completed payment entries against any booking - falsely confirming reservations as paid without executing a real financial transaction. The vulnerable REST endpoint performs no authorization or ownership validation, making any booking ID on an affected site a viable target. A publicly available proof-of-concept exists per WPScan; however, EPSS remains at 0.15% (4th percentile), and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated remote attackers to overwrite or delete internal booking notes for any reservation by supplying an arbitrary booking ID. The root cause is a nonce that is unconditionally output into every public page's HTML via wp_localize_script under MPHB._data.nonces, meaning any site visitor - without an account or any prior interaction - can obtain a valid nonce and invoke the update-booking-notes AJAX action against any booking. No public exploit code has been identified at time of analysis, but the trivially accessible nonce makes this effectively zero-friction to abuse.