Authorization Bypass in MotoPress Hotel Booking Plugin for WordPress

CVE-2026-8684

What is CVE-2026-8684?

The MotoPress Hotel Booking plugin for WordPress contains a vulnerability that allows attackers to bypass authorization checks. This issue affects all versions up to and including 6.0.1. An unauthenticated attacker can exploit the vulnerability to overwrite or delete the internal booking notes of any reservation by submitting a valid booking ID. The vulnerability arises because the nonce, which is supposed to ensure that actions are authorized, is exposed in the HTML source of every public page, allowing any visitor to obtain it and perform actions without proper authorization.

References