Authorization Bypass Vulnerability in MotoPress Appointment Booking Plugin for WordPress

CVE-2026-9180

What is CVE-2026-9180?

The MotoPress Appointment Booking plugin for WordPress is susceptible to an authorization bypass vulnerability that allows unauthenticated attackers to manipulate booking information. The REST endpoint POST /motopress/appointment/v1/bookings is improperly secured, permitting any user to access it without verification. Attackers can submit requests to alter non-confirmed bookings, changing details such as customer name, email, phone number, and customer ID. They can exploit public endpoints to gather potential booking IDs, making it easy to target vulnerable entries. This issue highlights the need for stringent permission checks on sensitive operations within WordPress plugins.

References