CVE-2026-15235: MotoPress Hotel Booking Info Disclosure

CVE-2026-15235 Overview

CVE-2026-15235 is a missing authorization vulnerability in the MotoPress Hotel Booking plugin for WordPress before version 6.0.4. The plugin exposes an AJAX action that returns a booking's full customer details without performing a capability check. Any authenticated user with a Subscriber-level account or higher can invoke the action and read personal data belonging to any customer, including name, email address, phone number, and postal address. The flaw sits in broken access control [CWE-862] rather than authentication, so exploitation requires only a low-privileged WordPress account on the target site.

Critical Impact
Authenticated low-privileged users can exfiltrate personal identifiable information (PII) for every booking customer stored in the plugin.

Affected Products

MotoPress Hotel Booking WordPress plugin versions prior to 6.0.4
WordPress sites running vulnerable plugin versions with open user registration
Hotel, rental, and reservation sites using the MotoPress Hotel Booking AJAX booking workflow

Discovery Timeline

2026-07-30 - CVE-2026-15235 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-15235

Vulnerability Analysis

The MotoPress Hotel Booking plugin registers AJAX actions that operate on booking records containing customer PII. One of these actions returns the full booking object, including guest contact details, when invoked by any authenticated session. The handler validates the request nonce but omits a current_user_can() capability check on the calling user. As a result, WordPress evaluates only whether the user is logged in and holds a valid nonce, not whether the user owns the booking or holds a management role.

On WordPress installations that allow open registration, an attacker can create a Subscriber account, obtain a valid nonce from any page that outputs one, and iterate booking identifiers to enumerate customers. The impact is confidentiality-focused: no code execution or write access is provided, but the exposed dataset is directly usable for phishing, account takeover on third-party services, and physical targeting through disclosed addresses.

Root Cause

The root cause is a missing authorization check in the AJAX endpoint that returns booking details. The handler treats nonce possession as sufficient proof of authority and does not verify the caller holds a role such as administrator or hotel_booking_manager, nor that the caller is the customer associated with the booking identifier being requested.

Attack Vector

Exploitation follows a standard authenticated Insecure Direct Object Reference (IDOR) pattern. The attacker authenticates as a Subscriber, retrieves a valid AJAX nonce from a rendered page, and submits POST requests to admin-ajax.php with the vulnerable action name and an incrementing booking ID parameter. Each successful response returns the target booking's customer record. See the WPScan Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2026-15235

Indicators of Compromise

High-volume POST requests to /wp-admin/admin-ajax.php from a single authenticated Subscriber session
Sequential or enumerated booking_id (or equivalent) parameter values in AJAX request logs
Unexpected Subscriber-role account creations on sites that do not require public registration

Detection Strategies

Review web server access logs for repeated admin-ajax.php calls referencing MotoPress Hotel Booking action names originating from low-privileged sessions.
Correlate WordPress authentication logs with AJAX activity to flag Subscribers issuing booking-related queries they have no business reason to make.
Deploy a Web Application Firewall (WAF) rule that counts booking-detail AJAX responses per session and alerts on volumetric enumeration.

Monitoring Recommendations

Enable verbose logging for the MotoPress Hotel Booking plugin and forward logs to a centralized SIEM for retention and query.
Alert on newly created WordPress user accounts followed within minutes by AJAX traffic to plugin endpoints.
Monitor outbound egress of large JSON payloads from admin-ajax.php responses to detect bulk PII exfiltration.

How to Mitigate CVE-2026-15235

Immediate Actions Required

Upgrade the MotoPress Hotel Booking plugin to version 6.0.4 or later on all WordPress sites.
Audit existing WordPress user accounts and remove unrecognized Subscriber-level accounts created before patching.
Review AJAX request logs for the period preceding the upgrade to identify potential prior data exposure and notify affected customers as required by applicable data protection law.

Patch Information

MotoPress addressed the issue in Hotel Booking version 6.0.4 by adding a capability check to the affected AJAX action. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Disable open user registration under Settings → General → Membership until the plugin is upgraded.
Restrict access to /wp-admin/admin-ajax.php at the WAF layer for MotoPress Hotel Booking action names, allowing only requests from users in privileged roles.
Temporarily deactivate the MotoPress Hotel Booking plugin on sites that cannot be patched immediately and that store live customer data.

bash

# Configuration example: block anonymous and Subscriber-level access to the vulnerable action via WordPress mu-plugin
# Place in wp-content/mu-plugins/block-mphb-ajax.php until plugin is upgraded to 6.0.4
add_action('init', function () {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        $action = isset($_REQUEST['action']) ? (string) $_REQUEST['action'] : '';
        if (strpos($action, 'mphb_') === 0 && !current_user_can('edit_others_posts')) {
            wp_send_json_error('forbidden', 403);
        }
    }
});