CVE-2026-15232
Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.
| Vendor | unknown |
| Product | motopress appointment booking |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown motopress appointment booking
Be the first to know when new medium vulnerabilities affecting unknown motopress appointment booking are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / MotoPress Appointment Booking
0 < 2.4.8
References
Credits
Ahmed Hashim Ismael WPScan