Description
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MotoPress Hotel Booking | < 6.2.3 | 6.2.3 |
References
- https://wpscan.com/vulnerability/7283a28a-7241-4b9e-8fc5-5b427191c80e/ exploit vdb-entry technical-description