Booking Rental Manager CVE-2026-103350

The vulnerable Booking and Rental Manager for WooCommerce plugin (version 2.8.0 or earlier) must be installed and active on a WordPress site, which also implies a WooCommerce environment given the plugin's dependency. Exploitation targets a booking/rental quantity input that is improperly validated (CWE-1284); per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is required against such an installation. Limiting factors: impact is confined to integrity of booking functionality (I:L) with no data exposure or site takeover, and the precise vulnerable feature/endpoint is not detailed in the Patchstack-derived description, so the concrete trigger input should be confirmed against the vendor advisory.

This is a medium-severity issue (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) that scores network-exploitable, low-complexity, and unauthenticated (PR:N), but its real-world impact is deliberately narrow: integrity-only and partial (I:L), with no confidentiality (C:N) or availability (A:N) effect. No EPSS score was provided in the input, so statistical exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The practical ceiling of impact is 'Removing Important Client Functionality' - degradation of a WordPress/WooCommerce booking feature rather than data theft or server compromise - making this a lower-priority, patch-in-normal-cycle item despite the easy-to-trigger network vector. Note a signal conflict: the input Tags include 'Information Disclosure,' yet the CVSS vector explicitly sets C:N (no confidentiality impact) and only I:L, so the information-disclosure label appears inaccurate and should not drive prioritization - verify against the Patchstack advisory.

A remote, unauthenticated attacker submits a crafted request to a booking endpoint of the Booking and Rental Manager plugin (versions through 2.8.0) with an improperly validated quantity value (CWE-1284), under the low-complexity network vector indicated by CVSS (AV:N/AC:L/PR:N/UI:N). The manipulated input causes the plugin to remove or disrupt important client-facing booking functionality, partially affecting integrity (I:L). No public exploit code was identified in the provided intelligence.