[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDanfr-tULT6EuLx89LmlSl9Wukr7cLuakSPdHzkSXIc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57347","motopress-hotel-booking-authenticated-subscriber-information-exposure","MotoPress Hotel Booking \u003C= 6.0.3 - Authenticated (Subscriber+) Information Exposure","The MotoPress Hotel Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.","motopress-hotel-booking-lite",null,"\u003C=6.0.3","6.0.4","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-07-01 00:00:00","2026-07-09 13:45:22",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F9978a072-9f6c-4fa2-b414-b18e0c10ee61?source=api-prod",9,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fadmin.css","assets\u002Fcss\u002Fadmin.min.css","assets\u002Fcss\u002Fmphb.css","assets\u002Fcss\u002Fmphb.min.css","includes\u002Fadvanced\u002Fapi\u002Fcontrollers\u002Fv1\u002Fcreate-block-controller.php","includes\u002Fadvanced\u002Fapi\u002Fcontrollers\u002Fv1\u002Fdelete-block-controller.php","includes\u002Fadvanced\u002Fapi\u002Fcontrollers\u002Fv1\u002Fdelete-blocks-controller.php","includes\u002Fadvanced\u002Fapi\u002Fcontrollers\u002Fv1\u002Fget-block-controller.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-57347 - MotoPress Hotel Booking Information Exposure\n\n## 1. Vulnerability Summary\nThe **MotoPress Hotel Booking** plugin (including the Lite version) is vulnerable to **Sensitive Information Exposure** via its REST API. In versions up to and including 6.0.3, the REST API endpoints for managing \"Booking Blocks\" (rules that restrict dates or rooms) do not implement sufficient capability checks. This allows authenticated users with low-level privileges, such as **Subscribers**, to access internal booking rules, room configuration data, and potentially sensitive comments associated with date blocks.\n\nThe vulnerability resides in the controllers located in `includes\u002Fadvanced\u002Fapi\u002Fcontrollers\u002Fv1\u002F`, specifically within the `GetBlockController` class, which lacks an adequately restrictive `permission_callback`.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-json\u002Fmphb\u002Fv1\u002Fbooking_rules\u002Fblocks\u002F(?P\u003Cblock_id>[\\d]+)`\n- **HTTP Method:** `GET` (for Information Exposure)\n- **Authentication:** Required (Subscriber role is sufficient).\n- **REST Namespace:** `mphb\u002Fv1` (inferred from `MPHB\\Advanced\\Api\\Controllers\\V1`).\n- **REST Route:** `booking_rules\u002Fblocks\u002F`\n- **Payload:** A valid `block_id` (integer) passed in the URL.\n- **Preconditions:** At least one \"Block\" (booking rule) must exist in the system for exposure.\n\n## 3. Code Flow\n1. **Entry Point:** The REST API server receives a request for `GET \u002Fwp-json\u002Fmphb\u002Fv1\u002Fbooking_rules\u002Fblocks\u002F{block_id}`.\n2. **Controller Routing:** The request is routed to `MPHB\\Advanced\\Api\\Controllers\\V1\\GetBlockController`.\n3. **Capability Check (The Vulnerability):** The controller (via its parent `AbstractRestCommandController`) uses a `permission_callback` that likely only checks if the user is logged in (`is_user_logged_in()`) or has a very low-level capability, rather than checking for `manage_options` or `edit_posts`.\n4. **Data Retrieval:** The `process_and_get_data_by_response_schema( \\WP_REST_Request $request )` function is called.\n5. **Logic Path:**\n    - It retrieves the `block_id` via `$request->get_param( 'block_id' )`.\n    - It calls `MPHB()->getBlocksRepository()->getItem( $blockId )`.\n6. **Sink:** The block data is returned as a JSON object, exposing properties like `comment`, `date_from`, `date_to`, `room_id`, and `room_type_id` (defined in `RestApiSchemaHelper::getBlockProperties()`).\n\n## 4. Nonce Acquisition Strategy\nREST API requests in WordPress require a `_wpnonce` parameter or an `X-WP-Nonce` header when using cookie-based authentication. Since the attacker is a Subscriber, they can log into the WordPress dashboard and extract the global REST nonce.\n\n1. **Login:** Authenticate as a Subscriber user.\n2. **Access Dashboard:** Navigate to `\u002Fwp-admin\u002Fprofile.php`.\n3. **Extract Nonce:** Use `browser_eval` to extract the nonce from the `wpApiSettings` object which is standard in WordPress admin pages.\n   - **JS Command:** `browser_eval(\"wpApiSettings.nonce\")`\n4. **Usage:** Include this nonce in the `X-WP-Nonce` header of the subsequent API request.\n\n## 5. Exploitation Strategy\n### Step 1: Data Discovery (Optional but recommended)\nIf specific `block_id` values are unknown, an attacker might try to list all blocks if a plural `GetBlocksController` exists (standard REST pattern). If not, they can brute-force IDs (e.g., 1, 2, 3).\n\n### Step 2: Extract Sensitive Data\n**Request:**\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fmphb\u002Fv1\u002Fbooking_rules\u002Fblocks\u002F1`\n- **Method:** `GET`\n- **Headers:**\n    - `X-WP-Nonce: [EXTRACTED_NONCE]`\n    - `Content-Type: application\u002Fjson`\n    - `Cookie: [SUBSCRIBER_COOKIES]`\n\n**Expected Vulnerable Response:**\n```json\n{\n  \"block_id\": 1,\n  \"comment\": \"Internal Note: VIP guest, do not overbook. Customer phone: +123456789\",\n  \"date_from\": \"2024-12-01\",\n  \"date_to\": \"2024-12-10\",\n  \"room_id\": 45,\n  \"room_type_id\": 10,\n  \"has_restrictions\": true\n}\n```\n\n## 6. Test Data Setup\nTo verify the exposure, a \"Block\" must be created by an Admin:\n1. Log in as **Admin**.\n2. Go to **Accommodation** -> **Booking Rules**.\n3. Create a **New Block** (Restriction).\n4. Enter a sensitive comment: `Secret: Room maintenance needed for guest John Doe`.\n5. Note the ID of the created block (can be found in the database table `wp_mphb_blocks` or by checking the URL in the admin UI).\n6. Create a **Subscriber** user.\n\n## 7. Expected Results\n- **Vulnerable:** The Subscriber receives a `200 OK` response with the full block object, including the `comment` field.\n- **Fixed:** The Subscriber receives a `403 Forbidden` or `401 Unauthorized` response with a message indicating they lack permission to view this resource.\n\n## 8. Verification Steps\n1. **WP-CLI Verification:** After the exploit, verify the data matches the database.\n   - `wp db query \"SELECT * FROM wp_mphb_blocks WHERE block_id = 1;\"`\n2. **Check Access Logs:** Ensure the request was made by the Subscriber user ID.\n\n## 9. Alternative Approaches\nIf `GET` access is blocked but the vulnerability title implies broader exposure, investigate:\n- `POST \u002Fwp-json\u002Fmphb\u002Fv1\u002Fbooking_rules\u002Fblocks`: Creating a block as a Subscriber.\n- `DELETE \u002Fwp-json\u002Fmphb\u002Fv1\u002Fbooking_rules\u002Fblocks\u002F1`: Deleting blocks as a Subscriber (`DeleteBlockController`).\n- Brute-forcing `block_id` values using a script to dump the entire `wp_mphb_blocks` table via the `GET` endpoint.","gemini-3-flash-preview","2026-07-25 12:21:12","2026-07-25 12:21:40",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","6.0.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotopress-hotel-booking-lite\u002Ftags\u002F6.0.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmotopress-hotel-booking-lite.6.0.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotopress-hotel-booking-lite\u002Ftags\u002F6.0.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmotopress-hotel-booking-lite.6.0.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotopress-hotel-booking-lite\u002Ftags"]