CVE-2026-15237: MotoPress Hotel Booking Auth Bypass Flaw

CVE-2026-15237 Overview

CVE-2026-15237 is a missing authorization vulnerability [CWE-862] in the MotoPress Hotel Booking WordPress plugin before version 6.2.3. The plugin exposes a REST endpoint that creates payment records without performing authorization or ownership checks. Unauthenticated attackers can call this endpoint to create completed payment records against arbitrary bookings and falsely mark them as paid. The flaw affects the integrity of booking and payment data managed by the plugin, enabling free reservations or manipulation of financial records on affected sites.

Critical Impact
Unauthenticated remote attackers can mark arbitrary hotel bookings as paid, corrupting payment integrity for any site running MotoPress Hotel Booking below 6.2.3.

Affected Products

MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3
WordPress sites exposing the plugin's payment REST endpoint
Hospitality and reservation workflows dependent on MotoPress payment status

Discovery Timeline

2026-08-10 - CVE-2026-15237 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-15237

Vulnerability Analysis

The MotoPress Hotel Booking plugin registers a REST API route that creates payment records tied to bookings. The route handler does not verify the caller's identity, capability, or ownership of the referenced booking. Any client that can reach the WordPress REST API can invoke the endpoint and submit a payload that inserts a payment record with a completed status against a chosen booking ID. Because the payment status drives the booking's paid state, the record change causes the plugin to treat the booking as settled without any funds moving.

Root Cause

The root cause is a missing authorization check in the REST endpoint's permission callback. WordPress REST routes rely on a permission_callback to gate access, but the affected route accepts requests from unauthenticated users and lacks a nonce, capability check, or booking-owner validation. This aligns with CWE-862: Missing Authorization.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker enumerates or guesses booking identifiers, then sends an HTTP request to the vulnerable REST endpoint with a JSON body that specifies the booking ID and a completed payment status. The server accepts the request, writes a payment record, and updates the booking to reflect payment. No credentials, user interaction, or elevated privileges are required.

A verified proof-of-concept exploit is not publicly available. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-15237

Indicators of Compromise

Unexpected POST requests to MotoPress Hotel Booking REST routes from unauthenticated sessions or unknown IP addresses
Payment records marked as completed with no matching gateway transaction ID or processor confirmation
Bookings transitioning to a paid state outside the site's normal checkout flow or business hours

Detection Strategies

Review web server access logs for requests to /wp-json/ paths associated with the MotoPress Hotel Booking plugin, correlating source IPs with legitimate customer traffic
Reconcile plugin payment records against the payment gateway's transaction ledger to identify entries that lack a corresponding gateway charge
Alert on bookings whose paid status changes without a preceding checkout session or authenticated admin action

Monitoring Recommendations

Enable WordPress REST API request logging and forward logs to a centralized SIEM for retention and correlation
Monitor the wp_posts and MotoPress payment tables for insertions from unauthenticated contexts
Track anomalous spikes in completed bookings that do not map to referral traffic or gateway activity

How to Mitigate CVE-2026-15237

Immediate Actions Required

Update the MotoPress Hotel Booking plugin to version 6.2.3 or later on all WordPress installations
Audit payment records and booking status changes from the plugin's release date forward to identify falsely marked payments
Reconcile plugin payment data against the payment gateway ledger and reverse any fraudulent bookings

Patch Information

The vendor has released MotoPress Hotel Booking version 6.2.3, which introduces authorization and ownership validation on the affected REST endpoint. Site administrators should upgrade through the WordPress plugin manager or by replacing the plugin files with the fixed release. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to the WordPress REST API at the web application firewall (WAF) layer, blocking unauthenticated requests to MotoPress Hotel Booking routes until the patch is applied
Temporarily disable the MotoPress Hotel Booking plugin on sites that cannot be updated immediately, especially where online payment status drives fulfillment
Require staff review of any booking flagged as paid before honoring reservations until reconciliation is complete

bash

# Example WAF rule concept to block unauthenticated POSTs to the plugin's REST namespace
# Adapt the namespace to match the plugin's actual REST route in your environment
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:1,deny,status:403,id:1026152370,\
   msg:'Block unauthenticated MotoPress Hotel Booking REST payment creation (CVE-2026-15237)'"
  SecRule REQUEST_URI "@rx ^/wp-json/mphb/" \
    "chain"
    SecRule &REQUEST_HEADERS:Cookie "@eq 0"