MotoPress Appointment Booking Unauthenticated IDOR Vulnerability Advisory (CVE-2026-9180)

Vulnerability Overview Vulnerability Name: MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter CVE ID: CVE-2026-9180 CVSS Score: 5.3 (Medium) Release Date: July 2, 2026 Last Updated: July 3, 2026 Researcher: g0whr Vulnerability Description: The MotoPress Appointment Booking plugin for WordPress, versions 2.4.4 and below, contains an authentication bypass vulnerability. This vulnerability allows unauthenticated attackers to access REST endpoints via user-controlled keys, thereby retrieving customer data such as names, email addresses, phone numbers, etc. Attackers can exploit this vulnerability to overwrite existing booking objects, causing to load and persist an existing booking object, thus obtaining the victim's booking ID. Scope of Impact Software Type: Plugin Software Name: motopress-appointment-booking Affected Versions: <= 2.4.4 Fixed Version: 2.4.5 Remediation Recommendation: Upgrade to version 2.4.5 or higher. References plugins.trac.wordpress.org Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days, 1-hour response time Disclaimer This record contains copyrighted material. Copyright owners are Defiant Inc. and MITRE Corporation. Contact For any questions or if you need more information, please contact: wfi-support@wordfence.com Additional Resources Wordfence Intelligence: Provides free access to the WordPress vulnerability database API. Wordfence Plugin: Can be installed on WordPress sites to receive timely notifications of the latest vulnerabilities. Footer Information Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or Share My Personal Information Social Media Twitter: X Facebook: f LinkedIn: in Instagram: O Products and Services Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Stay Updated: Subscribe to news and updates provided by experienced security professionals. Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Cherubic: Cherubic --- Note: No Proof of Concept (POC) code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

MotoPress Appointment Booking Unauthenticated IDOR Vulnerability Advisory (CVE-2026-9180)

More from this source