CVE-2025-14065
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Description
The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni' AJAX action in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve all booking records containing customers' personally identifiable information (PII), including names, email addresses, and phone numbers.
Analysis
Simple Bike Rental WordPress plugin versions up to 1.0.6 allow authenticated subscribers to retrieve sensitive customer booking data due to missing capability checks on the 'simpbire_carica_prenotazioni' AJAX action. Attackers with subscriber-level access can exfiltrate personally identifiable information including names, email addresses, and phone numbers from all booking records. CVSS 4.3 reflects the moderate severity of unauthorized information disclosure without requiring administrative access.
Technical Context
The vulnerability stems from an AJAX handler ('simpbire_carica_prenotazioni') that lacks proper WordPress capability verification (CWE-862: Missing Authorization). WordPress capabilities control user access to admin functions; the flaw permits any authenticated user at subscriber level or above to invoke this AJAX action directly without capability checks, bypassing intended access controls. The vulnerability is located in the plugin's ajax.php file, where the action handler processes and returns booking records. This is a classic WordPress privilege escalation pattern where subscriber roles-typically limited to managing their own content-gain unauthorized access to administrative data.
Affected Products
Simple Bike Rental WordPress plugin in all versions up to and including 1.0.6. The plugin is hosted on WordPress.org plugin repository. Organizations using this plugin for bike rental booking management with subscriber-level registrations are at risk. Reference the plugin's changeset history at https://plugins.trac.wordpress.org/changeset/3414692/simple-bike-rental/ and advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/06f4e758-3328-4ac1-956a-cfadddd12e53.
Remediation
Update Simple Bike Rental to version 1.0.7 or later, which implements proper WordPress capability checks on the vulnerable AJAX action. Site administrators should immediately upgrade via WordPress admin plugin dashboard (Plugins > Installed Plugins > Simple Bike Rental > Update). If immediate patching is not possible, consider temporarily restricting subscriber role creation or limiting subscriber permissions via user role editor plugins until patched. Review booking records and customer PII exposure; if the site is public-facing, consider notifying users of the potential exposure. Confirmation of the patched version is available in the plugin repository changeset history referenced above.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today