CVE-2026-15232: Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MotoPress Appointment Booking (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.4.8 - Compensating control
For sites using payment confirmation and versions like 2.4.7 where the deletion is still reachable, restrict access to the unauthenticated booking-deletion endpoint (the unauthenticated endpoint that accepts a user-supplied booking identifier) to trusted users/IPs via firewall/ACL until the site is upgraded to 2.4.8.
Event History
Frequently Asked Questions
Which sites are exposed to the remaining deletion path?
The remaining issue is confirmed on sites using payment confirmation. On those sites, the unauthenticated endpoint can still reach reservation deletion through version 2.4.7.
What does an attacker need to delete a reservation?
An attacker needs to supply a booking identifier to the unauthenticated endpoint. No authentication, authorization, or proof of ownership is required.
What is the impact if exploitation succeeds?
An attacker can permanently delete reservations belonging to other users. The issue affects MotoPress Appointment Booking Lite versions before 2.4.8.