Car Rental Manager CVE-2026-61985

Exploitation requires that the target WordPress site has the Car Rental Manager plugin installed and active in version 1.3.7 or earlier. The CVSS vector PR:N/UI:N/AC:L confirms that no authentication, elevated privileges, or victim interaction are required - the vulnerable endpoint is accessible to any HTTP client that can reach the WordPress installation. The specific plugin feature, AJAX action, or REST route that lacks authorization checks is not disclosed in publicly available data, which adds a minor discovery barrier. Exploitation is limited to integrity impact (I:L); there is no confirmed path to data disclosure (C:N) or denial of service (A:N) from this flaw alone. Standard WordPress hardening (blocking xmlrpc.php, restricting wp-admin) would reduce but not eliminate exposure.

The CVSS 3.1 base score of 5.3 Medium is supported by the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating trivial remote exploitability with no authentication barrier, but limited to a partial integrity impact with no confidentiality or availability consequences. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept code has been identified, which meaningfully reduces the near-term threat. The product's niche deployment base (car rental businesses using a specific WordPress plugin) further constrains the realistic attack surface. The primary concern is unauthorized modification of rental data, bookings, or plugin configuration by unauthenticated actors - a genuine operational risk for affected site owners, but not a systemic or mass-exploitation scenario.

An unauthenticated attacker discovers a WordPress site running Car Rental Manager ≤1.3.7, then sends a crafted HTTP POST request directly to the plugin's unprotected AJAX handler or REST endpoint, bypassing the missing authorization check. The attacker successfully modifies rental booking records, plugin settings, or vehicle availability data without holding any WordPress account. No exploit code has been publicly released, so exploitation currently requires manual discovery of the specific vulnerable endpoint.