Booking Rental Manager EUVD-2026-109718

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication, no user interaction, and no special privileges - a remote attacker can reach the vulnerable functionality against a default installation of Booking and Rental Manager for WooCommerce (versions up to and including 2.8.2). The description identifies the weakness as missing/incorrectly configured access control (CWE-862) but does not name the exact feature, endpoint, or parameter that lacks the authorization check, so the precise trigger is not described in the available sources. The principal limiting factor is impact scope: the flaw only affects integrity at a low level (C:N/I:L/A:N), so it permits unauthorized modification of some data but not disclosure of confidential data or denial of service; exploitation also requires the vulnerable plugin to be installed and network-reachable (a public-facing WordPress/WooCommerce site).

This is a medium-severity (CVSS 5.3) broken access control / missing authorization flaw (CWE-862) in the Booking and Rental Manager WooCommerce plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a low-barrier attack path - remotely reachable, low complexity, no privileges, no user interaction - but impact is constrained to integrity only (C:N/I:L/A:N), meaning an attacker can alter some data but cannot read confidential data or disrupt availability. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit was provided (the only reference is the Patchstack database entry, not working exploit code), so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with the limited integrity-only impact: this is a genuine but non-urgent fix rather than a high-CVSS-but-low-real-risk mislabel or a drop-everything emergency. The main risk driver is the unauthenticated network vector; the main risk limiter is the low, integrity-only technical impact.

A remote, unauthenticated attacker sends crafted HTTP requests to a plugin endpoint that fails to enforce an authorization check, allowing them to perform an action or modify booking/rental data they should not be able to change. No public exploit code was identified at time of analysis, and the specific affected endpoint is not described in the available sources. Because no authentication or user interaction is required, the action can be scripted against any exposed site running the vulnerable plugin.