Booking Rental Manager CVE-2026-78258

The target WordPress installation must have the Booking and Rental Manager plugin by MagePeople Inc. installed, active, and running at version 2.7.5 or earlier - deactivated or uninstalled plugins are not exploitable. No authenticated session is required; the CVSS PR:N metric confirms unauthenticated exploitation is possible. No user interaction is needed (UI:N), and no special network position is required (AV:N), so any internet-reachable WordPress site qualifies. The impact is bounded to confidentiality (C:L) - attackers cannot write data or affect availability through this specific flaw (I:N/A:N). Exploitation is constrained to whichever specific plugin endpoints lack authorization checks; the full set of exposed endpoints is not enumerated in available intelligence.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a Medium-severity, network-exploitable, zero-complexity unauthenticated read - low attack bar but constrained blast radius. No EPSS score was included in the provided intelligence, so exploitation probability cannot be quantified against the broader threat landscape. No CISA KEV listing exists, and no public exploit code has been identified, which are meaningful risk-dampening signals. The impact ceiling is limited confidentiality loss (C:L) with no integrity or availability dimension (I:N/A:N), meaning an attacker can exfiltrate only a subset of plugin-managed data and cannot modify records or disrupt service through this vector alone. The real-world priority depends heavily on the sensitivity of the booking data exposed - sites handling PII, payment metadata, or corporate scheduling data face greater business risk than the raw CVSS score implies. The combination of PR:N and AC:L does make this trivially automatable at scale via mass WordPress scanning, so organizations running WooCommerce booking infrastructure should not deprioritize it solely on the basis of the medium score.

An unauthenticated attacker sends a crafted HTTP POST request to the WordPress AJAX endpoint or a REST API route registered by the vulnerable plugin, omitting any session token or nonce. The missing authorization check allows the request to succeed, returning restricted booking or rental records in the response. No public exploit code has been identified at the time of analysis, but the low attack complexity (AC:L) and absence of any authentication requirement (PR:N) mean that exploitation requires only knowledge of the vulnerable endpoint name, which could be discovered through plugin source code inspection.