What is the CVSS score of CVE-2026-61985?

CVE-2026-61985 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Car Rental Manager CVE-2026-61985

EUVD-2026-43321 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Car Rental Manager Magepeopleteam

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable plugin endpoint requires no authentication; only partial integrity impact confirmed, with no confidentiality or availability consequence described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:20 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.

AnalysisAI

Missing authorization controls in the Car Rental Manager WordPress plugin (≤1.3.7) allow unauthenticated remote attackers to exploit incorrectly configured access control levels, resulting in limited integrity impact. The CVSS vector (PR:N/UI:N) confirms exploitation requires no credentials or user interaction against any publicly reachable WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world risk at a moderate level despite the trivial exploitation conditions.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that the requesting principal holds the necessary permissions before executing a privileged operation. In WordPress plugins, this typically manifests as the absence of current_user_can() capability checks - or the use of misconfigured nonce/role checks - on AJAX handlers, REST API routes, or admin-page actions. The affected product, identified by CPE cpe:2.3:a:magepeopleteam:car_rental_manager:*:*:*:*:*:*:*:*, is a plugin by magepeopleteam that manages vehicle rental workflows inside WordPress. The Patchstack tag 'Broken Access Control' corroborates that one or more plugin endpoints accept and act on requests without enforcing WordPress capability gates, allowing callers at lower privilege levels (or no privilege at all, per PR:N) to trigger functionality intended for authorized roles.

RemediationAI

Update the Car Rental Manager plugin beyond version 1.3.7 as soon as a patched release is available from the plugin author (magepeopleteam). No specific patched version number is confirmed in available data - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/car-rental-manager/vulnerability/wordpress-car-rental-manager-plugin-1-3-7-broken-access-control-vulnerability and the WordPress Plugin Repository for the latest release status. As an interim compensating control, consider disabling the plugin until a fix is confirmed, accepting the trade-off of losing rental management functionality. Alternatively, web application firewall (WAF) rules that restrict unauthenticated POST requests to the plugin's known AJAX or admin endpoints can reduce exposure, though the specific vulnerable endpoints are not publicly disclosed at this time. Restricting wp-admin and wp-login.php access by IP range is a general hardening measure that limits the attack surface for WordPress plugin flaws of this class.