MotoPress Hotel Booking Plugin Information Disclosure Vulnerability

Executive Summary

This vulnerability is in the MotoPress Hotel Booking WordPress plugin before version 6.0.4. It allows any authenticated user with a low-privileged account, such as a Subscriber, to access sensitive customer data without proper permission checks. The flaw exists in an AJAX action that fails to verify user capabilities before returning full customer details like names, emails, phone numbers, and addresses.

Useful 0 Not Useful 0

Detection Guidance

Check if the MotoPress Hotel Booking plugin version is below 6.0.4. Exploit attempts may involve sending requests to admin-ajax.php with the mphb_get_admin_calendar_booking_info action. Monitor for unauthorized access to customer data via this endpoint.

Useful 0 Not Useful 0

Impact Analysis

If you are a WordPress site owner using the affected plugin version, attackers could exploit this to steal customer personal data. For users, their private information like contact details and addresses could be exposed without their knowledge. The vulnerability enables unauthorized access to sensitive data through crafted requests to the admin-ajax.php endpoint.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing personal customer data without authorization. It enables unauthorized access to sensitive information, which could lead to non-compliance with privacy requirements mandating strict access controls and protection of personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MotoPress Hotel Booking plugin to version 6.0.4 or later. Remove low-privileged user access if not required. Implement strict capability checks for AJAX actions. Monitor admin-ajax.php for suspicious activity targeting booking data.

Useful 0 Not Useful 0