CVE-2026-8684: MotoPress Hotel Booking Auth Bypass Flaw

CVE-2026-8684 Overview

CVE-2026-8684 is an authorization bypass vulnerability in the MotoPress Hotel Booking plugin for WordPress. All versions up to and including 6.0.1 are affected. The plugin fails to verify that the requesting user is authorized to update booking notes before processing AJAX requests. Unauthenticated attackers can overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce required for the action is exposed in the HTML source of every public page through wp_localize_script (MPHB._data.nonces), allowing any visitor to obtain a valid nonce without authentication. The vulnerability maps to [CWE-862] Missing Authorization.

Critical Impact

Unauthenticated attackers can tamper with or destroy internal booking notes on any affected WordPress site running MotoPress Hotel Booking, leading to integrity loss in reservation records.

Affected Products

• MotoPress Hotel Booking plugin for WordPress, versions up to and including 6.0.1
• MotoPress Hotel Booking Lite (shared update-booking-notes AJAX action codebase)
• WordPress sites publicly exposing pages that load the plugin's frontend script

Discovery Timeline

• 2026-05-22 - CVE-2026-8684 published to NVD
• 2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-8684

Vulnerability Analysis

The flaw resides in the plugin's AJAX API handler for the update-booking-notes action. The handler validates a WordPress nonce but does not validate the caller's role or capability. The booking ID is taken from the request and used to overwrite the _mphb_booking_internal_notes post meta value of any booking. Because the nonce check is the sole gate, and that nonce is shipped to anonymous visitors, the authorization control collapses entirely. Attackers can corrupt or erase notes that hotel operators rely on for guest preferences, payment records, or internal flags. Confidentiality is not impacted, but integrity of operational booking data is.

Root Cause

The abstract-ajax-api-action.php base class and the update-booking-notes.php handler perform a nonce verification but omit a current_user_can() or equivalent capability check. The plugin's wp_localize_script call exposes MPHB._data.nonces to every page visitor, so the nonce is not a secret and provides no authentication value. The result is broken access control consistent with [CWE-862] Missing Authorization.

Attack Vector

An unauthenticated attacker first loads any public page of the target site to read the localized MPHB._data.nonces value from the HTML source. The attacker then issues a POST request to the WordPress admin-ajax.php endpoint, invoking the update-booking-notes action with the captured nonce and an arbitrary numeric booking ID. The handler updates or deletes _mphb_booking_internal_notes for that booking without verifying user identity or role. No user interaction or prior account is required.

// No verified exploit code is published.
// See vendor source references for the vulnerable handler implementation:
// includes/ajax-api/ajax-actions/update-booking-notes.php (line 83)
// includes/ajax-api/ajax-api-handler.php (line 43)

Detection Methods for CVE-2026-8684

Indicators of Compromise

• Unexpected modifications or deletions of the _mphb_booking_internal_notes post meta field across multiple booking IDs
• POST requests to /wp-admin/admin-ajax.php with action=update-booking-notes originating from unauthenticated sessions or anomalous IP addresses
• Sudden enumeration patterns hitting sequential booking IDs in AJAX request logs

Detection Strategies

• Inspect WordPress access logs for admin-ajax.php requests carrying the update-booking-notes action without an authenticated session cookie
• Compare current _mphb_booking_internal_notes values against backups to identify unauthorized overwrites or deletions
• Deploy a Web Application Firewall (WAF) rule that requires an authenticated administrator or hotel-manager role for the update-booking-notes AJAX action

Monitoring Recommendations

• Enable verbose access logging on wp-admin/admin-ajax.php and forward logs to a centralized SIEM for correlation
• Alert on high-rate POSTs targeting booking-related AJAX actions from a single source IP
• Track database audit events on the wp_postmeta table for changes to keys beginning with _mphb_

How to Mitigate CVE-2026-8684

Immediate Actions Required

• Update the MotoPress Hotel Booking plugin to a release later than 6.0.1 that includes the fix from changeset 3537354
• Back up the wp_postmeta table to preserve current internal booking notes before applying updates
• Restrict access to admin-ajax.php from untrusted networks where feasible, particularly for update-booking-notes

Patch Information

The vendor addressed the missing authorization check in the WordPress Changeset for Booking Notes. Administrators should upgrade to the patched release that adds a capability check to the update-booking-notes handler. Full vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Deploy a WAF rule blocking unauthenticated POSTs to admin-ajax.php with action=update-booking-notes
• Temporarily deactivate the MotoPress Hotel Booking plugin on internet-facing sites until the patch is applied
• Use a custom must-use plugin to enforce current_user_can('edit_posts') (or stricter) before the AJAX action executes

# Example WAF rule (ModSecurity) blocking unauthenticated update-booking-notes calls
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,id:1026868401,phase:2,deny,status:403,msg:'Block MotoPress update-booking-notes (CVE-2026-8684)'"
  SecRule ARGS:action "@streq update-booking-notes" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"