Authenticated User Privilege Escalation in MotoPress Hotel Booking

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the MotoPress Hotel Booking WordPress plugin before version 6.2.3. It allows any authenticated user with low privileges, such as a Subscriber, to modify or overwrite the personal data of any customer by providing an arbitrary identifier. The plugin fails to verify record ownership before updating customer records.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of the MotoPress Hotel Booking plugin installed on your WordPress site. If it is below 6.2.3, the system is vulnerable. You can verify the version by inspecting the plugin files or using WordPress admin panel.

Useful 0 Not Useful 0

Impact Analysis

If you use the vulnerable plugin, attackers with low-privileged accounts could access and alter sensitive customer data, leading to privacy breaches, data corruption, or unauthorized changes to bookings. This could harm your business reputation and customer trust.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing or allowing unauthorized modification of personal data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and fines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the MotoPress Hotel Booking plugin to version 6.2.3 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Ensure all user accounts follow the principle of least privilege.

Useful 0 Not Useful 0