Booking And Rental Manager CVE-2026-23972

While a CVSS score and EPSS probability are not available, the real-world risk is moderate to high given the vulnerability class and scope. Missing authorization (CWE-862) in WooCommerce booking systems typically allows attackers with low or no privileges to modify bookings, view sensitive rental information, or manipulate payment data—constituting a technical impact of high confidentiality and integrity loss. The WordPress plugin ecosystem exhibits frequent exploitation of access control flaws due to widespread deployment and lower average security maturity compared to standalone applications. However, without confirmation of active exploitation (KEV status) or public proof-of-concept code, this is not an immediate critical threat; organizations running the affected plugin versions should prioritize patching, but this does not warrant emergency incident response. The missing CVSS/EPSS data suggests the vulnerability may be relatively recent or still under embargo.

An unauthenticated attacker or low-privilege user (such as a customer or guest) submits a direct HTTP request to the plugin's booking management endpoint, exploiting the missing authorization check. Because the endpoint does not verify user capabilities before processing the request, the attacker can view, modify, or cancel bookings belonging to other users, access rental contract details, or manipulate pricing information. If the plugin also exposes REST API endpoints without proper authorization, attackers can perform these actions programmatically at scale without leaving obvious traces in the WordPress admin interface.