CVE-2026-9180: WordPress Plugin Auth Bypass Vulnerability

CVE-2026-9180 Overview

The MotoPress Appointment Booking plugin for WordPress contains an authorization bypass through user-controlled key vulnerability [CWE-639]. All versions up to and including 2.4.4 are affected. The POST /motopress/appointment/v1/bookings REST endpoint is registered with 'permission_callback' => '__return_true', which permits unauthenticated access. Attackers can supply an arbitrary payment_details.booking_id value, causing the createBooking handler to load and modify another user's booking. This allows overwriting the customer name, email address, phone number, and customer_id on any non-confirmed booking without authentication.

Critical Impact
Unauthenticated attackers can tamper with pending or auto-draft bookings by replacing legitimate customer contact details with attacker-controlled values.

Affected Products

MotoPress Appointment Booking plugin for WordPress (versions ≤ 2.4.4)
MotoPress Appointment Booking Lite plugin for WordPress (versions ≤ 2.4.4)
WordPress sites exposing the motopress/appointment/v1/bookings REST route

Discovery Timeline

2026-07-03 - CVE-2026-9180 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-9180

Vulnerability Analysis

The vulnerability resides in BookingsRestController.php, where the plugin registers the create-booking REST route with 'permission_callback' => '__return_true'. This effectively disables authorization on the endpoint. The createBooking handler accepts an attacker-supplied payment_details.booking_id and delegates to BookingService::createBooking(). That service calls findById() on the supplied identifier without verifying that the requester owns the booking or possesses any capability to modify it. When the request contains no reservation items, the service loads the referenced victim booking and persists it back with the attacker-controlled customer fields.

Exploitation requires knowledge of a target booking ID. Attackers can enumerate identifiers by querying the publicly accessible GET /motopress/appointment/v1/bookings/reservations endpoint using guessable service_id values and date ranges. Only bookings whose status is not STATUS_CONFIRMED — for example pending or auto-draft — are valid targets.

Root Cause

The root cause is a missing authorization check on a state-changing REST route combined with trust in a client-supplied object reference. The permission_callback returns true unconditionally, and the service layer never validates ownership of the booking identified by payment_details.booking_id. This is a textbook Insecure Direct Object Reference pattern classified under [CWE-639].

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker first queries the reservations endpoint to harvest non-confirmed booking IDs. The attacker then issues a POST request to /wp-json/motopress/appointment/v1/bookings with a JSON body containing the victim booking ID inside payment_details.booking_id, no reservation items, and attacker-controlled customer fields. The plugin loads the referenced booking and overwrites its customer name, email, phone, and customer_id.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report and the vendor changeset for technical details.

Detection Methods for CVE-2026-9180

Indicators of Compromise

Unauthenticated POST requests to /wp-json/motopress/appointment/v1/bookings originating from external IP addresses.
Unexplained modifications to customer name, email, phone, or customer_id fields on pending or auto-draft bookings.
Sequential or scripted GET requests to /wp-json/motopress/appointment/v1/bookings/reservations with varying service_id and date parameters.
Booking audit records showing customer field changes without a corresponding administrator session.

Detection Strategies

Inspect web server access logs for anonymous POST traffic to the motopress/appointment/v1/bookings route and correlate with subsequent booking record changes.
Enable database-level auditing on the MotoPress bookings tables to capture updates to customer_id, customer_name, customer_email, and customer_phone columns.
Alert on high request volume against the bookings/reservations endpoint, which indicates booking ID harvesting.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for correlation across the REST endpoints referenced above.
Baseline normal booking creation activity and flag deviations such as requests missing reservation items but containing a payment_details.booking_id.
Monitor customer-facing notification systems for complaints regarding altered contact details on existing appointments.

How to Mitigate CVE-2026-9180

Immediate Actions Required

Update the MotoPress Appointment Booking plugin to a version newer than 2.4.4 that includes the fix from changeset 3583168.
Audit existing pending and auto-draft bookings for altered customer data and restore trusted values from backups or original confirmation emails.
Restrict public access to the motopress/appointment/v1/bookings and motopress/appointment/v1/bookings/reservations routes at the web server or WAF layer until patching is complete.

Patch Information

The vendor addressed the issue in the MotoPress Appointment Booking plugin trunk via WordPress plugin changeset 3583168, which modifies the permission handling in BookingsRestController.php. Administrators should install the latest available release from the WordPress plugin repository and verify the plugin version reflects a release after 2.4.4.

Workarounds

Deploy a WAF rule to block unauthenticated POST requests to /wp-json/motopress/appointment/v1/bookings that include a payment_details.booking_id parameter.
Use a WordPress security filter to override the plugin's permission_callback and require authenticated administrator or booking-owner context.
Temporarily disable the MotoPress Appointment Booking plugin on sites that cannot immediately update.

bash

# Example ModSecurity rule to block the vulnerable request pattern
SecRule REQUEST_URI "@rx /wp-json/motopress/appointment/v1/bookings$" \
    "id:1029180,phase:2,deny,status:403,\
    chain,msg:'Block CVE-2026-9180 booking tamper attempt'"
    SecRule REQUEST_METHOD "@streq POST" \
        "chain"
        SecRule REQUEST_BODY "@contains payment_details" "t:none"