CVE-2026-9180: CWE-639 Authorization Bypass Through User-Controlled Key in jetmonsters MotoPress Appointment Booking
The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the `POST /motopress/appointment/v1/bookings` REST endpoint being registered with `'permission_callback' => '__return_true'`, allowing unauthenticated access, while the `createBooking` handler in `BookingsRestController.php` accepts an attacker-supplied `payment_details.booking_id` value and loads the referenced booking via `findById()` without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and `customer_id` of any non-confirmed victim booking by submitting a request with no reservation items, causing `BookingService::createBooking()` to load the existing victim booking object and persist it with attacker-controlled customer data. Victim booking IDs can be harvested prior to exploitation without authentication by querying the also-publicly-accessible `GET /motopress/appointment/v1/bookings/reservations` endpoint with a guessable `service_id` and date range, and only bookings whose status is not `STATUS_CONFIRMED` (e.g., pending or auto-draft) are valid targets.
AI Analysis
Technical Summary
CVE-2026-9180 is an authorization bypass vulnerability in the MotoPress Appointment Booking WordPress plugin versions up to and including 2.4.4. The vulnerability arises because the POST /motopress/appointment/v1/bookings REST endpoint is registered with a permission callback that always returns true, allowing unauthenticated access. The createBooking handler accepts an attacker-supplied payment_details.booking_id and loads the booking via findById() without verifying the caller's rights. Attackers can overwrite customer information on any non-confirmed booking by submitting a request with no reservation items. Booking IDs can be enumerated unauthenticated by querying the GET /motopress/appointment/v1/bookings/reservations endpoint with a guessable service_id and date range. Only bookings not in STATUS_CONFIRMED state are vulnerable.
Potential Impact
An unauthenticated attacker can modify customer data (name, email, phone number, customer_id) of any non-confirmed booking in the affected plugin versions. This could lead to data integrity issues and potential confusion or disruption of booking records. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST endpoints if possible or disable the MotoPress Appointment Booking plugin. Monitor for updates from the vendor or plugin maintainers regarding an official fix.
CVE-2026-9180: CWE-639 Authorization Bypass Through User-Controlled Key in jetmonsters MotoPress Appointment Booking
Description
The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the `POST /motopress/appointment/v1/bookings` REST endpoint being registered with `'permission_callback' => '__return_true'`, allowing unauthenticated access, while the `createBooking` handler in `BookingsRestController.php` accepts an attacker-supplied `payment_details.booking_id` value and loads the referenced booking via `findById()` without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and `customer_id` of any non-confirmed victim booking by submitting a request with no reservation items, causing `BookingService::createBooking()` to load the existing victim booking object and persist it with attacker-controlled customer data. Victim booking IDs can be harvested prior to exploitation without authentication by querying the also-publicly-accessible `GET /motopress/appointment/v1/bookings/reservations` endpoint with a guessable `service_id` and date range, and only bookings whose status is not `STATUS_CONFIRMED` (e.g., pending or auto-draft) are valid targets.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-9180 is an authorization bypass vulnerability in the MotoPress Appointment Booking WordPress plugin versions up to and including 2.4.4. The vulnerability arises because the POST /motopress/appointment/v1/bookings REST endpoint is registered with a permission callback that always returns true, allowing unauthenticated access. The createBooking handler accepts an attacker-supplied payment_details.booking_id and loads the booking via findById() without verifying the caller's rights. Attackers can overwrite customer information on any non-confirmed booking by submitting a request with no reservation items. Booking IDs can be enumerated unauthenticated by querying the GET /motopress/appointment/v1/bookings/reservations endpoint with a guessable service_id and date range. Only bookings not in STATUS_CONFIRMED state are vulnerable.
Potential Impact
An unauthenticated attacker can modify customer data (name, email, phone number, customer_id) of any non-confirmed booking in the affected plugin versions. This could lead to data integrity issues and potential confusion or disruption of booking records. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST endpoints if possible or disable the MotoPress Appointment Booking plugin. Monitor for updates from the vendor or plugin maintainers regarding an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-21T14:47:44.596Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a474a7527e9c797190a8369
Added to database: 07/03/2026, 05:36:53 UTC
Last enriched: 07/10/2026, 08:52:58 UTC
Last updated: 08/17/2026, 00:41:15 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.