Unauthenticated Payment Record Creation in MotoPress Hotel Booking Plugin

Executive Summary

This vulnerability is in the MotoPress Hotel Booking WordPress plugin before version 6.2.3. It allows unauthenticated users to create fake payment records by exploiting an unrestricted REST endpoint. The flaw lets attackers mark arbitrary bookings as paid without proper authorization or ownership checks.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site is running the MotoPress Hotel Booking plugin version before 6.2.3. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin directory for version details. Look for unauthorized payment records in the booking system.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to falsify payments for bookings, leading to financial losses or unauthorized access to services. It undermines trust in booking systems and may allow attackers to manipulate booking statuses without detection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to payment data and booking records. It may lead to breaches of data integrity and confidentiality, potentially resulting in penalties under GDPR or HIPAA for inadequate access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MotoPress Hotel Booking plugin to version 6.2.3 or later immediately. Remove or disable the plugin if an update is not available. Review booking records for suspicious payment entries created before the update.

Useful 0 Not Useful 0