WordPress Plugin Vulnerabilities

Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

Description

The plugin does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.

Proof of Concept

Affects Plugins

Plugin icon
motopress-appointment-lite
Fixed in 2.4.8

References

CVE
CVE-2026-15232

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ahmed Hashim Ismael
Submitter
Ahmed Hashim Ismael
Verified
Yes
WPVDB ID
b0ffa74d-a03a-4eed-95c7-579360990d7f

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2026-07-22
Title
Product Slider, Product Grid, Product Masonry < 1.13.63 - Authenticated (Contributor+) Insecure Direct Object Reference
Published
2023-09-22
Title
Pre-Publish Checklist < 1.1.2 - Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update
Published
2026-08-17
Title
YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration
Published
2023-07-26
Title
ACF Photo Gallery Field < 2.0 - Subscriber+ UserMeta Update
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read