What the vulnerability does
01Description
The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce for this action is output in the HTML source of every public page through wp_localize_script (MPHB._data.nonces), so any unauthenticated visitor can obtain a valid nonce and perform the action without any account or prior interaction.
Explanation of Vulnerability in Simple Terms
02Summary
MotoPress Hotel Booking versions up to 6.0.1 lack proper authorization checks, allowing unauthenticated attackers to modify data on the site. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 6.0.1 to remediate this issue.
What an attacker can do
03Attacker Capabilities
Modify site data without logging in or having permission to do so.
Potential impact on your site
04Site Impact
Unauthorized changes to hotel booking data, reservations, or other plugin-managed content.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 22, 2026
CVE published
May 22, 2026
Record updated
