CVE-2026-15232 in Appointment Booking Plugin
Summary
by MITRE • 09/02/2026
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The MotoPress Appointment Booking plugin for WordPress, prior to version 2.4.8, contains a critical authorization bypass vulnerability that allows unauthenticated attackers to permanently delete other users' reservations. This flaw stems from the application's failure to perform adequate ownership checks or verify user permissions when processing requests containing user-supplied booking identifiers on an endpoint accessible without authentication. By manipulating these identifiers, malicious actors can target specific reservation records and execute deletion operations against resources they do not own, effectively stripping legitimate customers of their appointments.
This vulnerability represents a significant operational impact for both service providers relying on the plugin to manage bookings and end-users who depend on the reliability of scheduled services. The ability to arbitrarily remove reservations disrupts business continuity, potentially leading to financial losses through canceled revenue and reputational damage due to perceived unreliability. Furthermore, because this issue is identified as an incomplete fix for CVE-2026-9180, it indicates that previous remediation efforts failed to fully address the underlying authorization logic gaps. The persistence of this flaw in version 2.4.7 and earlier confirms that even when payment confirmation workflows are enabled, the core security mechanism remains insufficiently robust against unauthorized access attempts.
From a technical perspective, this vulnerability aligns with CWE-862, which describes missing authorization checks, as well as CWE-913 regarding improper control of frequency limitation or other algorithmic limitations if rate limiting is also absent. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1530, Data from Information Repositories, specifically involving data deletion and exfiltration-like impacts through resource destruction. The attack vector leverages standard HTTP methods on exposed API endpoints or administrative functions that should strictly enforce identity verification before executing state-changing operations like deletions.
To mitigate this risk, administrators must immediately upgrade the MotoPress Appointment Booking plugin to version 2.4.8 or later, where these authorization checks have been properly implemented. Until an update is applied, site owners should consider implementing web application firewall rules that restrict access to sensitive booking endpoints based on IP reputation or require additional authentication tokens for deletion requests. Regular security audits and penetration testing are recommended to ensure that similar logic flaws do not exist in other plugins handling user-specific data within the WordPress ecosystem.