findById of the file /motopress/appointment/v1/bookings of the component REST Endpoint. Performing a manipulation of the argument payment_details.booking_id results in authorization bypass.
This vulnerability was named CVE-2026-9180. The attack may be initiated remotely. There is no available exploit.
Intelligence View
⚡ tsecurity.de Intelligence
CVE-2026-9180 | jetmonsters MotoPress Appointment Booking Plugin up to 2.4.4 on WordPress REST Endpoint bookings findById payment_details.booking_id authorization (EUVD-2026-41492)
Reagiere als Erste:r — dein Feedback zählt!
A vulnerability classified as critical has been found in jetmonsters MotoPress Appointment Booking Plugin up to 2.4.4 on WordPress. The impacted element is the function
SOCIAL SHARE CARD GENERATOR