CVE-2026-8684

Vulnerability

The MotoPress Hotel Booking plugin for WordPress versions up to and including 6.0.1 contains an authorization bypass vulnerability in the update-booking-notes AJAX action. The plugin fails to verify that the requesting user has permission to modify the internal notes (_mphb_booking_internal_notes) of a specific booking. The action only checks that the booking ID exists, not that the user is authorized to access it. Additionally, the nonce used for CSRF protection is output on every public page via wp_localize_script, making it accessible to any unauthenticated visitor [1].

Exploitation

An unauthenticated attacker can obtain the nonce from the HTML source of any public page by inspecting the MPHB._data.nonces JavaScript object. The attacker then sends a POST request to the WordPress AJAX endpoint with the action mphb_update_booking_notes, the nonce, and an arbitrary booking ID along with new note data. The plugin's getValidatedRequestData method in update-booking-notes.php only validates that the booking exists, not that the attacker has any relationship to it [2][3][4]. The attacker can supply an empty notes array to delete all notes or provide new note content to overwrite them.

Impact

Successful exploitation allows an unauthenticated attacker to overwrite or delete the internal notes of any booking in the system. This leads to data integrity loss, as internal notes may contain sensitive information or operational instructions. The attacker does not gain any other privileges or access to the booking's other data.

Mitigation

The vendor has released a fix in version 6.0.2 (or later) that adds proper authorization checks. Users should update to the latest version immediately. No workaround is available for versions prior to 6.0.2. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.