EUVD-2026-38690
GHSA-6r7v-ww2r-2qpr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description explicitly states read (C:L), write/create/update (I:L), and delete (A:L) capabilities; published C:N/A:N omits these per-description impacts.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The RentMy Real-Time Rental Management Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, and delete event records stored in the rentmy_events WordPress option, as well as overwrite the rentmy_locationId option.
AnalysisAI
Authorization bypass in the RentMy Real-Time Rental Management Plugin for WordPress exposes full CRUD control over rental event records and location configuration to unauthenticated remote attackers, affecting all versions through 4.0.4.1. The root cause is missing authorization checks in the plugin's AJAX handler class (class-rentmy-ajax.php), allowing any unauthenticated visitor to invoke privileged actions via WordPress's standard AJAX endpoint. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the zero-barrier entry point - unauthenticated, network-accessible, low complexity - means any exposed deployment is immediately at risk without requiring attacker sophistication.
Technical ContextAI
The vulnerability resides in the RentMy plugin's AJAX handler class at includes/class-rentmy-ajax.php, with vulnerable handler registrations identified at lines 16, 53, 73, and 83 per WordPress Trac source references. CWE-862 (Missing Authorization) indicates the plugin registers WordPress AJAX actions - likely using wp_ajax_nopriv_ hooks or equivalent patterns that permit unauthenticated invocation - but does not verify caller capabilities before processing sensitive operations. The affected data surfaces are the rentmy_events WordPress option, which stores event records central to rental management workflows, and the rentmy_locationId option, which governs location configuration. WordPress stores plugin options in the wp_options database table, making unauthorized writes to these keys a direct data integrity risk. The CPE cpe:2.3:a:rentmy:rentmy_real-time_rental_management_plugin:*:*:*:*:*:*:*:* confirms a single vendor product line with no platform-specific exclusions.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis - the CPE wildcard covering all versions through 4.0.4.1 indicates the fix version is not yet documented in NVD or Wordfence data. Administrators should monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/fd399ed3-03b2-477c-b38c-549d6066b6e8?source=cve) and the WordPress plugin repository for an update. As an immediate compensating control, deactivating the plugin eliminates all exposure at the cost of losing rental management functionality - the most effective mitigation until a patch is available. If plugin functionality cannot be interrupted, deploying a WAF rule to block unauthenticated POST requests to wp-admin/admin-ajax.php targeting RentMy-specific action parameters reduces exploitation surface, though this requires knowledge of the specific action names registered at class-rentmy-ajax.php lines 16, 53, 73, and 83. Restricting wp-admin/admin-ajax.php access by IP to known administrative ranges is a broader workaround but may break legitimate front-end AJAX functionality for other plugins.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today