What is the CVSS score of CVE-2026-57404?

CVE-2026-57404 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Booking and Rental Manager CVE-2026-57404

EUVD-2026-43477 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

Authentication Bypass WordPress Booking And Rental Manager

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible missing authorization with no authentication required per CVSS and description; impact limited to partial integrity and availability, no confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:25 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.9.

AnalysisAI

Missing authorization in the Booking and Rental Manager WordPress plugin (≤ 2.6.9) exposes unauthenticated remote attackers to broken access control, enabling unauthorized modification of booking data and partial disruption of plugin availability. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication or user interaction against any internet-facing WordPress/WooCommerce site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforwardly exploitable once a target is identified.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that a requester holds sufficient permission before allowing an operation to proceed - distinct from authentication bypass (CWE-287), which concerns identity verification. In WordPress plugin architecture, this typically manifests as REST API endpoints, AJAX handlers (wp_ajax_nopriv_*), or admin-facing actions that omit capability checks (e.g., current_user_can()), allowing any HTTP client to invoke privileged plugin functionality. The affected component is identified by CPE cpe:2.3:a:magepeopleteam:booking_and_rental_manager:*:*:*:*:*:*:*:*, a WooCommerce-dependent booking and rental management plugin authored by magepeopleteam. The vulnerability was discovered and reported by Patchstack, a WordPress-focused vulnerability intelligence platform.

RemediationAI

No vendor-released patch version was specified in the available input data; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-6-9-broken-access-control-vulnerability should be consulted for the latest patched release. If a patched version has been published to the WordPress plugin repository, update immediately via the WordPress admin dashboard or wp-cli (wp plugin update booking-and-rental-manager-for-woocommerce). As a compensating control where immediate patching is not feasible, consider temporarily deactivating the plugin (trade-off: loss of booking functionality), or using a web application firewall rule to block unauthenticated POST requests to the plugin's AJAX or REST endpoints - the specific endpoints should be identified from the Patchstack advisory. Access to the WordPress admin panel should also be restricted by IP where operationally feasible.