CVE-2026-9180
The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the POST /motopress/appointment/v1/bookings REST endpoint being registered with 'permission_callback' => '__return_true', allowing unauthenticated access, while the createBooking handler in BookingsRestController.php accepts an attacker-supplied payment_details.booking_id value and loads the referenced booking via findById() without verifying that the caller owns or has any rights to that booking. This makes it possible for unauthenticated attackers to overwrite the customer name, email address, phone number, and customer_id of any non-confirmed victim booking by submitting a request with no reservation items, causing BookingService::createBooking() to load the existing victim booking object and persist it with attacker-controlled customer data. Victim booking IDs can be harvested prior to exploitation without authentication by querying the also-publicly-accessible GET /motopress/appointment/v1/bookings/reservations endpoint with a guessable service_id and date range, and only bookings whose status is not STATUS_CONFIRMED (e.g., pending or auto-draft) are valid targets.
⚡ Watch CVE-2026-9180
Get an email if CVE-2026-9180 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-9180)