Booking and Rental Manager CVE-2026-57404

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions are required for network exploitation - any unauthenticated HTTP client can attempt to trigger the missing authorization flaw against a default installation of Booking and Rental Manager ≤ 2.6.9 running on WordPress with WooCommerce. Exploitation is limited to sites where this specific plugin is installed and active; the vulnerability does not affect WordPress core or WooCommerce itself. The impact is bounded to integrity (I:L) and availability (A:L) - no confidentiality impact (C:N) is assessed, meaning attackers cannot read booking customer data through this vector alone. The absence of a scope change (S:U) means exploitation is contained to the plugin's own data and functionality.

The CVSS 6.5 (Medium) score reflects network accessibility with no authentication or complexity requirements, but scope is unchanged and impact is limited to I:L/A:L with no confidentiality loss, capping the score below High. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No KEV listing exists, and no public proof-of-concept code has been identified, reducing immediate urgency. The realistic priority is moderate: the attack requires no privileges and no user interaction, making it trivially automatable for mass WordPress scanning campaigns, but the bounded impact (no data exfiltration, partial integrity/availability only) limits blast radius. The 'Authentication Bypass' tag applied by Patchstack is terminologically imprecise - the root cause is missing authorization (CWE-862), not a bypass of the authentication mechanism itself. Defenders should treat this as a prioritized patch for any internet-exposed WooCommerce stores using this plugin, particularly those handling real customer booking data where unauthorized manipulation could cause business disruption.

An unauthenticated attacker scans for WordPress sites running Booking and Rental Manager ≤ 2.6.9 using automated WordPress plugin fingerprinting, then sends a crafted HTTP POST request directly to the plugin's unprotected AJAX handler or REST endpoint, bypassing the missing capability check. The attacker manipulates booking records or disrupts availability of the booking system without holding any WordPress account. No public proof-of-concept has been identified, but the low attack complexity (AC:L, PR:N) means exploitation requires only knowledge of the vulnerable endpoint.