EUVD-2026-68786
GHSA-925v-8fmq-r6fc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable plugin action; subscriber account required (PR:L); no confidentiality or availability impact - integrity-only write operation.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
AnalysisAI
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress subscriber-level (or higher) account on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N accurately represents the threat profile: network-reachable, low complexity, but requiring at minimum a subscriber account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Booking and Rental Manager plugin to a version above 2.7.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Booking And Rental Manager
View allPHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attacker
Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions t
Missing authorization in the Booking and Rental Manager WordPress plugin (≤ 2.6.9) exposes unauthenticated remote attack
Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) perm
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today