VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 5 known issues Latest disclosed May 21, 2026

MotoPress Hotel Booking Vulnerabilities

Review known vulnerability records for the WordPress plugin MotoPress Hotel Booking (`motopress-hotel-booking-lite`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-8684, CVE-2025-66078 and CVE-2024-4413, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
5
High or Critical
2
Patch Coverage
100%
Last Updated
May 21, 2026
Related Security Guides

Use these guides while reviewing MotoPress Hotel Booking fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize MotoPress Hotel Booking remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
5
1. Match the Package
Confirm the installed WordPress plugin slug is motopress-hotel-booking-lite before acting on any CVE from this cluster.
2. Sort by Severity
Start with 2 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
5 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2024-4413 Critical
Vulnerability remediation for MotoPress Hotel Booking

Affected range: Versions up to 4.11.1. Fixed version: 4.11.2.

CVE-2023-5991 Critical
Remote Code Execution remediation for MotoPress Hotel Booking

Affected range: Versions before 4.8.5. Fixed version: 4.8.5.

CVE-2026-8684 Medium
Authorization Bypass remediation for MotoPress Hotel Booking

Affected range: Versions up to 6.0.1. Fixed version: 6.0.2.

CVE-2025-66078 Medium
Remote Code Execution remediation for MotoPress Hotel Booking

Affected range: Versions up to 5.2.3. Fixed version: 5.2.4.

Priority CVE Quick Links

Fast paths into MotoPress Hotel Booking CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
5
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2024-4413
Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection
 Vulnerability Versions up to 4.11.1 4.11.2 CVSS 9.8
CVE-2023-5991
Hotel Booking Lite <= 4.8.4 - Insufficient Path Validation to Unauthenticated Arbitr...
 Remote Code Execution Versions before 4.8.5 4.8.5 CVSS 9.8
CVE-2026-8684
MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrar...
 Authorization Bypass Versions up to 6.0.1 6.0.2 CVSS 5.3
CVE-2025-66078
Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution
 Remote Code Execution Versions up to 5.2.3 5.2.4 CVSS 5.3
CVE-2023-28498
Hotel Booking Lite <= 4.6.0 - Cross-Site Request Forgery to Settings Update
 Cross-Site Request Forgery Versions up to 4.6.0 4.7.0 CVSS 4.3
CVE-2024-4413 Critical 4.11.2
CVE-2024-4413 MotoPress Hotel Booking Vulnerability

Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection

CVE-2023-5991 Critical 4.8.5
CVE-2023-5991 MotoPress Hotel Booking Remote Code Execution

Hotel Booking Lite <= 4.8.4 - Insufficient Path Validation to Unauthenticated Arbitrary File Deletion and Download

CVE-2026-8684 Medium 6.0.2
CVE-2026-8684 MotoPress Hotel Booking Authorization Bypass

MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action

CVE-2025-66078 Medium 5.2.4
CVE-2025-66078 MotoPress Hotel Booking Remote Code Execution

Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution

CVE-2023-28498 Medium 4.7.0
CVE-2023-28498 MotoPress Hotel Booking Cross-Site Request Forgery

Hotel Booking Lite <= 4.6.0 - Cross-Site Request Forgery to Settings Update

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for MotoPress Hotel Booking so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
5 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
2 critical and 0 high severity findings.
Recent CVEs
CVE-2026-8684, CVE-2025-66078 and CVE-2024-4413
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for MotoPress Hotel Booking

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-8684
CVE-2026-8684: MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action

The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacker...

Published
May 21, 2026
Patched Release
6.0.2
Affected Versions
Versions up to 6.0.1
Next Step
Update to 6.0.2 or newer if supported.
Review CVE-2026-8684 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-66078
CVE-2025-66078: Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution

The MotoPress Hotel Booking plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.2.3. This makes it possible for authenticated attackers, with Hotel Worker-level access and above, to execute code on the server.

Published
Nov 25, 2025
Patched Release
5.2.4
Affected Versions
Versions up to 5.2.3
Next Step
Update to 5.2.4 or newer if supported.
Review CVE-2025-66078 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2024-4413
CVE-2024-4413: Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection

The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the...

Published
May 10, 2024
Patched Release
4.11.2
Affected Versions
Versions up to 4.11.1
Next Step
Update to 4.11.2 or newer if supported.
Review CVE-2024-4413 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2023-5991
CVE-2023-5991: Hotel Booking Lite <= 4.8.4 - Insufficient Path Validation to Unauthenticated Arbitrary File Deletion and Download

The Hotel Booking Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the maybeDownload() function and insufficient path validation in all versions up to 4.8.5 (exclusive). This makes it possible for unauthenticated to...

Published
Dec 01, 2023
Patched Release
4.8.5
Affected Versions
Versions before 4.8.5
Next Step
Update to 4.8.5 or newer if supported.
Review CVE-2023-5991 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-28498
CVE-2023-28498: Hotel Booking Lite <= 4.6.0 - Cross-Site Request Forgery to Settings Update

The Hotel Booking Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.6.0. This is due to missing or incorrect nonce validation on the 'render' and 'onLoad' functions. This makes it possible for unauthenticated attackers to up...

Published
Mar 16, 2023
Patched Release
4.7.0
Affected Versions
Versions up to 4.6.0
Next Step
Update to 4.7.0 or newer if supported.
Review CVE-2023-28498 fixed version details Open CVE Reference