G0Wthr

**Name of the Vulnerable Software and Affected Versions** MotoPress Appointment Booking versions prior to 2.4.5 **Description** The plugin contains an authorization bypass issue allowing unauthenticated users to modify booking details. The `POST /motopress/appointment/v1/bookings` endpoint is accessible to anyone because it uses a permissive callback. The `createBooking()` function in `BookingsRestController.php` processes the `payment details.booking id` variable without verifying the requester's permissions. By submitting a request without reservation items, an attacker can overwrite the customer name, email, phone number, and `customer id` of any booking that is not yet confirmed. Additionally, the `GET /motopress/appointment/v1/bookings/reservations` endpoint can be used to harvest valid booking IDs by providing a `service id` and a date range. **Recommendations** Update MotoPress Appointment Booking to version 2.4.5 or later. As a temporary mitigation, restrict access to the `POST /motopress/appointment/v1/bookings` and `GET /motopress/appointment/v1/bookings/reservations` endpoints.