Unauthorized Deletion Vulnerability in MotoPress Appointment Booking Plugin
CVE-2026-15232

Currently unrated

Key Information:

Vendor

WordPress
Status
Motopress Appointment Booking
Vendor
CVE Published:
2 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15232?

The MotoPress Appointment Booking WordPress plugin suffers from an improper access control vulnerability that allows unauthenticated attackers to delete other users' reservations. This issue arises due to a lack of necessary authorization checks when processing user-supplied booking identifiers through an unauthenticated endpoint. Although previous fixes were implemented for related vulnerabilities, the exploit remains viable for users on affected versions, particularly those utilizing payment confirmation features.

Affected Version(s)

MotoPress Appointment Booking 0 < 2.4.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15232 - Proof of Concept

References

https://wpscan.com/vulnerability/b0ffa74d-a03a-4eed-95c7-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ahmed Hashim Ismael
WPScan
.