CVE-2026-15232 MotoPress CVE debrief

Who should care

Site administrators and defenders using the MotoPress Appointment Booking WordPress plugin should assess exposure and prioritize verification and remediation. They should review reservations, monitor for suspicious activity, and verify and update the plugin to prevent unauthorized deletions.

Why it matters

CVE-2026-15232 allows unauthenticated attackers to delete reservations in MotoPress Appointment Booking WordPress plugin. Defenders should verify and update the plugin, review reservations, and monitor for suspicious activity.

• Unauthenticated attackers can permanently delete other users' reservations
• Site administrators need to verify and update the plugin to prevent unauthorized deletions
• Defenders should review site's booking reservations for potential unauthorized deletions

Technical summary

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7. WPScan vulnerability page explicitly identifies the MotoPress Appointment Booking WordPress plugin as the affected product.

Defensive priority

Defenders should prioritize verifying and updating the MotoPress Appointment Booking WordPress plugin to version 2.4.8 or later, and review their site's booking reservations for potential unauthorized deletions.

Recommended defensive actions

• Verify and update the MotoPress Appointment Booking WordPress plugin to version 2.4.8 or later
• Review site's booking reservations for potential unauthorized deletions
• Monitor site's booking system for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. WPScan vulnerability page explicitly identifies the MotoPress Appointment Booking WordPress plugin as the affected product.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.