Booking and Rental Manager CVE-2026-54850

Requires an authenticated WordPress account at subscriber privilege level on a site running Booking and Rental Manager (vendor magepeopleteam) version 2.8.2 or earlier (PR:L). No user interaction and no special non-default product configuration is indicated by the supplied data, and the flaw is network-reachable with low complexity (AV:N/AC:L/UI:N). The primary limiting factor is the need for a valid subscriber account: this is a strong barrier on sites that disable public registration, but negligible on sites with open self-registration (WordPress default allows this when 'Anyone can register' is enabled). Impact is confined to unauthorized disclosure of data (C:H, I:N, A:N); the exact affected endpoint or feature is not described in the available sources.

This is a moderate-severity authorization flaw (CVSS 6.5) rather than a top-priority emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, low-complexity issue requiring authenticated low-privileged access (PR:L - consistent with the 'Subscriber Broken Access Control' description) with no user interaction, and a confidentiality-only impact (C:H, I:N, A:N) - meaning it leaks sensitive data but does not itself allow modification or disruption. The vuln.today decision label is 'this_month', signaling a planned-remediation priority, not act_now/emergency. No EPSS score, no CISA KEV listing, and no confirmed exploit code were supplied, so there is no evidence of active or widespread exploitation; the single reference is a Patchstack advisory page, not a working PoC. The notable gating factor is that an attacker must already hold a subscriber account - a meaningful barrier on closed sites but trivial on WordPress installs with open self-registration enabled. The 'Authentication Bypass' tag conflicts with CWE-862 (Missing Authorization) and the 'Broken Access Control' description: this is an authorization/access-control failure for an already-authenticated subscriber, not a true authentication bypass - treat the mechanism as authorization escalation of data access.

An attacker registers (or already holds) a subscriber-level account on a WordPress site running Booking and Rental Manager <= 2.8.2, then sends a crafted request to a plugin endpoint that fails to enforce proper authorization, returning booking or customer data the subscriber should not be able to read. Because the vector is network-based with low complexity and no user interaction (AV:N/AC:L/UI:N), the request can be issued directly once a subscriber session exists. No public working exploit code was identified in the provided data.