Security Alert Summary
The MotoPress Appointment Booking WordPress plugin before 2.4.8 fails to perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint. This allows unauthenticated attackers to permanently delete other users’ reservations. The issue is described as an incomplete fix of CVE-2026-9180 and the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
CVE Details
- CVE ID: CVE-2026-15232
- Affected component: MotoPress Appointment Booking WordPress plugin
- Affected versions: versions prior to 2.4.8 (less than 2.4.8). Deletion remained reachable through version 2.4.7 on sites using payment confirmation.
- Published: September 2, 2026 at 6:17:16 AM
- Last modified: September 2, 2026 at 11:17:18 AM
- CVSS v3.1: Base score 5.3, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / Privileges / User interaction: Authentication required: No; Privileges required: None; User interaction: None
- Primary impact: Confidentiality: None; Integrity: Low (unauthenticated deletion of reservations); Availability: None
- CWE: CWE-639 (authorization bypass through user-controlled input)
Technical Details
The plugin contains an unauthenticated endpoint that accepts a user-supplied booking identifier and does not perform an authorization or ownership check before acting on that identifier. Because the endpoint is reachable without authentication and lacks ownership verification, an attacker supplying a booking identifier can cause the deletion of reservations belonging to other users.
The report states this is an incomplete remediation of a previous issue (CVE-2026-9180). On sites using payment confirmation, the deletion behavior remained reachable and was confirmed through version 2.4.7. The description does not name specific function names or parameter names, so assessment should focus on any unauthenticated endpoints that process booking identifiers and on ownership/authorization checks around deletion operations.
Impact is limited to integrity (permanent deletion of booking records). The CVSS data indicates no confidentiality or availability impact for this vulnerability.
How This Could Impact Your Website
Consider a small business using the plugin to manage client appointments. A site owner, internal staff member, and an external contractor all interact with the bookings system:
- A site owner relies on the bookings list to manage schedules and revenue; deleted reservations can lead to missed appointments and lost revenue.
- Internal staff who handle scheduling and customer communications may face an increased support burden when customers report missing or cancelled bookings.
- An external contractor or third-party integration that reconciles bookings could see data inconsistencies, complicating reporting and accounting.
Practically, unauthenticated deletion of reservations can disrupt operations, damage customer trust, and increase administrative workload; it can also open opportunities for attackers to cause confusion or attempt social-engineering attacks that exploit canceled appointments. If you're unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level or similar roles with content access.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and audit third-party integrations that handle bookings.
- Monitor site activity and booking logs for unusual deletion events or repeated unauthenticated requests to booking endpoints.
If you'd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
