What is the CVSS score of CVE-2026-23972?

CVE-2026-23972 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Booking And Rental Manager are affected by CVE-2026-23972?

CVE-2026-23972 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-23972?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Booking And Rental Manager CVE-2026-23972

EUVD-2026-15545 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-43fq-73ph-565p

WordPress Authentication Bypass Booking And Rental Manager Wordpress Plugin Magepeopleteam

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15545

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.

AnalysisAI

The Booking and Rental Manager plugin for WordPress through version 2.6.0 contains an authorization bypass that allows authenticated attackers to modify data they should not have access to. An attacker with low-privilege user credentials can exploit inadequately enforced access controls to perform unauthorized actions. No patch is currently available for this vulnerability.

Technical ContextAI

The vulnerability stems from inadequate authorization checks in the Booking and Rental Manager WordPress plugin (identified by CPE cpe:2.3:a:magepeopleteam:booking_and_rental_manager:*:*:*:*:*:*:*:*), which extends WooCommerce functionality to manage booking and rental transactions. CWE-862 (Missing Authorization) indicates that the application fails to properly enforce access control policies when processing user requests, allowing attackers to perform privileged operations without proper role-based or capability-based authorization verification. This is a common pattern in WordPress plugins where capability checks via functions like current_user_can() are either absent or improperly implemented, particularly affecting REST API endpoints or form handlers that interact with booking data and rental management workflows.

RemediationAI

Update the Booking and Rental Manager plugin to a version beyond 2.6.0 immediately; the vendor should release a patched version addressing the access control deficiency. Until an update is available, restrict access to the plugin's administrative functions and booking management endpoints to trusted IP addresses via Web Application Firewall (WAF) rules or server-level restrictions, disable public-facing REST API endpoints if not explicitly required, and audit user role assignments to ensure only authorized administrators possess capability to modify booking records. Monitor booking logs for suspicious activity indicating unauthorized access. Verify that all access control checks use proper WordPress capability functions (current_user_can(), user_can()) on both the backend and any API endpoints. Consult the vendor advisory at the Patchstack reference link for patch availability and specific upgrade instructions.