Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 14:03:08 +0000 CVE-2026-15232 — Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion https://vulnerability.circl.lu/vuln/cve-2026-15232 <p><strong>Affected:</strong> Unknown MotoPress Appointment Booking</p> <p>The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users&#39; reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.</p> <p><strong>Affected:</strong> Unknown MotoPress Appointment Booking</p> <p>The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users&#39; reservations. This is an incomplete fix of CVE-2026-9180: the deletion remains reachable on sites using payment confirmation, confirmed through version 2.4.7.</p> https://vulnerability.circl.lu/vuln/cve-2026-15232