CVE-2026-15238: MotoPress Hotel Booking Auth Bypass Flaw

CVE-2026-15238 Overview

CVE-2026-15238 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the MotoPress Hotel Booking WordPress plugin before version 6.2.3. The plugin fails to verify record ownership before updating customer records. Any authenticated user with a low-privileged account (Subscriber or above) can supply an arbitrary customer identifier to modify or overwrite the personal data of any customer stored by the plugin.

Critical Impact
Authenticated attackers with minimal privileges can tamper with the personal data of arbitrary hotel booking customers, resulting in unauthorized modification of personally identifiable information (PII).

Affected Products

MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3
WordPress sites running the plugin with open user registration (Subscriber role)
Hotel and rental booking deployments relying on this plugin for customer management

Discovery Timeline

2026-08-10 - CVE-2026-15238 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-15238

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference flaw affecting the customer record update workflow in MotoPress Hotel Booking. The plugin exposes an authenticated endpoint that accepts a customer identifier and a set of field values, then updates the corresponding record without validating that the requesting user owns or has permission to modify that record.

Because the authorization check is missing, the plugin trusts the supplied identifier as authoritative. An attacker with a Subscriber-level account can iterate through customer IDs and overwrite each record's personal data fields. The attack requires no user interaction and can be performed remotely over the network.

The impact is limited to integrity and confidentiality of customer records handled by the plugin. Availability of the site is not directly affected. Data affected typically includes names, email addresses, phone numbers, and booking-related personal information.

Root Cause

The root cause is a missing authorization check on the customer update handler. The plugin performs authentication verification but does not tie the customer record to the current user's identity. This is a canonical CWE-639: Authorization Bypass Through User-Controlled Key pattern.

Attack Vector

The attack vector is network-based over HTTP(S). An attacker registers a Subscriber account on any WordPress site running the vulnerable plugin, authenticates, and issues a crafted request to the customer update endpoint. The request supplies an arbitrary numeric customer ID along with attacker-controlled field values.

Exploitation code is not required beyond a standard HTTP client. Refer to the WPScan Vulnerability Advisory for endpoint and parameter details.

Detection Methods for CVE-2026-15238

Indicators of Compromise

Unexpected modifications to customer records in the MotoPress Hotel Booking tables, particularly changes made by low-privileged user accounts.
Authenticated HTTP requests to the plugin's customer update endpoint originating from Subscriber-level sessions.
Sequential or enumerated customer IDs in request logs targeting the plugin's admin-ajax or REST handlers.

Detection Strategies

Review WordPress audit logs for POST requests to MotoPress Hotel Booking endpoints where the acting user role is Subscriber or Customer.
Correlate database change events on the mphb_customers (or equivalent) table with the WordPress user ID performing the change.
Alert on any single authenticated session that updates multiple customer records within a short time window.

Monitoring Recommendations

Enable a WordPress activity logging plugin and forward events to a central log platform for retention and analysis.
Monitor new Subscriber account registrations followed by immediate requests to plugin endpoints.
Track outbound and inbound requests to /wp-admin/admin-ajax.php and /wp-json/ paths referencing MotoPress Hotel Booking actions.

How to Mitigate CVE-2026-15238

Immediate Actions Required

Update the MotoPress Hotel Booking plugin to version 6.2.3 or later on all affected WordPress sites.
Audit existing customer records for unauthorized modifications since the plugin was installed.
Review and, where feasible, disable open user registration or restrict the default Subscriber role until patching is complete.

Patch Information

MotoPress addressed the missing ownership check in version 6.2.3 of the Hotel Booking plugin. Site administrators should upgrade through the WordPress plugin manager or by replacing the plugin files with the latest release. See the WPScan Vulnerability Advisory for the authoritative fix reference.

Workarounds

Disable the MotoPress Hotel Booking plugin until it can be updated to 6.2.3 or later.
Set users_can_register to false in WordPress general settings to prevent unauthenticated actors from obtaining Subscriber accounts.
Deploy a web application firewall rule to block requests to the plugin's customer update endpoints from non-administrative user sessions.

bash

# Disable open registration via WP-CLI
wp option update users_can_register 0

# Update the vulnerable plugin to the patched release
wp plugin update motopress-hotel-booking --version=6.2.3