CyberRota Analysis
AI-GeneratedThe MotoPress Hotel Booking plugin for WordPress prior to version 6.0.4 is vulnerable due to inadequate capability checks, enabling authenticated users with low privileges (Subscriber and above) to access sensitive customer information, such as names, emails, phone numbers, and addresses, through AJAX actions. This exposure of personal data poses a privacy risk and could lead to unauthorized data access. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential data breaches.
Original NVD Description
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.