Car Rental Manager CVE-2026-112825

Exploitation requires a running WordPress site with the Magepeople Car Rental Manager plugin at a version from n/a through 1.5.3, and the attacker must hold a valid authenticated account on that site (CVSS PR:L indicates low-privilege authentication is needed, not anonymous access). The limiting factors are therefore: a valid low-tier account must be obtainable (relevant on sites allowing self-registration or customer accounts), and impact is confined to confidentiality (C:H, I:N, A:N) - the flaw does not by itself allow modifying data or taking the site down. No user interaction is required (UI:N). The exact vulnerable endpoint/feature and whether a fixed release exists are not described in the available sources.

This is a moderate-priority issue, not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity flaw that requires an already-authenticated low-privileged account (PR:L) and yields only a confidentiality impact (C:H, with I:N/A:N). CWE-862 (Missing Authorization) and the 'Broken Access Control' advisory title are consistent with the CVSS profile: an authenticated user reaches data or functionality that should be restricted. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a serious-but-not-urgent authenticated information-disclosure bug. Key corroborating signals are MISSING: no EPSS score was provided, there is no CISA KEV listing (so no confirmed active exploitation), and no SSVC exploitation/automatable/technical-impact values were supplied. The only reference is the Patchstack advisory itself - an advisory page, not verified working exploit code - so there is no confirmed public PoC. No conflict exists between CVSS and the description; both point to authenticated misuse of access controls over the network. Overall: a real but contained disclosure risk gated by requiring a valid (likely low-tier) WordPress account.

A low-privileged authenticated WordPress user (e.g. a subscriber or customer account on a site running Car Rental Manager ≤ 1.5.3) sends a crafted request to a plugin endpoint that fails to verify the caller's authorization. Because the authorization check is missing, the user retrieves booking or customer data they should not be able to see, causing a confidentiality breach. No public, verified exploit code was identified in the provided data.