CVE-2026-9180

Name of the Vulnerable Software and Affected Versions MotoPress Appointment Booking versions prior to 2.4.5

Description The plugin contains an authorization bypass issue allowing unauthenticated users to modify booking details. The POST /motopress/appointment/v1/bookings endpoint is accessible to anyone because it uses a permissive callback. The createBooking() function in BookingsRestController.php processes the payment details.booking id variable without verifying the requester's permissions. By submitting a request without reservation items, an attacker can overwrite the customer name, email, phone number, and customer id of any booking that is not yet confirmed. Additionally, the GET /motopress/appointment/v1/bookings/reservations endpoint can be used to harvest valid booking IDs by providing a service id and a date range.

Recommendations Update MotoPress Appointment Booking to version 2.4.5 or later. As a temporary mitigation, restrict access to the POST /motopress/appointment/v1/bookings and GET /motopress/appointment/v1/bookings/reservations endpoints.