What is the CVSS score of EUVD-2025-16685?

EUVD-2025-16685 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Booking and Rental Manager are affected by EUVD-2025-16685?

CVE-2025-47585 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate EUVD-2025-16685?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Booking and Rental Manager EUVD-2025-16685

| CVE-2025-47585 MEDIUM

Missing Authorization (CWE-862)

2025-06-02 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

AV:N, AC:L, PR:N, UI:N per description; impact limited to low I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 16:47 euvd

EUVD-2025-16685

Analysis Generated

Mar 14, 2026 - 16:47 vuln.today

CVE Published

Jun 02, 2025 - 20:15 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Mage people team Booking and Rental Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking and Rental Manager: from n/a through 2.3.8.

AnalysisAI

Missing authorization in Booking and Rental Manager for WooCommerce allows unauthenticated attackers to access functionality restricted by ACLs, potentially modifying bookings or rental settings. The vulnerability affects versions up to 2.3.8 and has a low EPSS score (0.07%) with no public exploit identified.

Technical ContextAI

The vulnerability is a Missing Authorization (CWE-862) in the WordPress plugin Booking and Rental Manager for WooCommerce. The plugin manages booking and rental functionality for WooCommerce stores. The CPE data indicates affected versions up to 2.3.8. The root cause is insufficient access control checks on certain plugin endpoints, allowing unauthenticated users to trigger actions that should require higher privileges.

RemediationAI

Update to version 2.3.9 or later, which contains the fix for the missing authorization vulnerability. The vendor advisory from Patchstack provides details. As a workaround, restrict access to the plugin's admin pages via .htaccess or a web application firewall (WAF) to block unauthenticated requests to sensitive endpoints, though this may affect legitimate functionality.