EUVD-2026-39665
GHSA-55q6-vh7x-32vm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable unauthenticated endpoint with no complexity; only limited integrity impact from unauthorized booking actions, no confidentiality or availability loss.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
AnalysisAI
Unauthenticated broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.1) allows remote unauthenticated attackers to perform restricted actions, resulting in unauthorized integrity modifications to booking or rental data. The flaw stems from missing authorization checks (CWE-862), meaning any network-accessible request can bypass intended access controls without credentials. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects the limited impact scope - integrity only, no confidentiality or availability loss.
Technical ContextAI
The affected component is the Booking and Rental Manager plugin for WooCommerce, a WordPress e-commerce extension used to manage bookings and rentals. CWE-862 (Missing Authorization) identifies the root cause: the plugin exposes one or more endpoints or AJAX actions without verifying that the requesting user has the authority to invoke them. WordPress plugins commonly register hooks via wp_ajax_nopriv_ (unauthenticated) or wp_ajax_ (authenticated) handlers; a missing capability check on a sensitive handler is the canonical realization of CWE-862 in this ecosystem. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over the network with no complexity, no privileges, and no user interaction - consistent with an exposed, unguarded REST or AJAX endpoint. The vulnerability was reported by Patchstack (audit@patchstack.com), a reputable WordPress-focused security research organization.
RemediationAI
No vendor-released patch version was confirmed in the available intelligence at time of analysis. Site operators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-7-1-broken-access-control-vulnerability and monitor the WordPress plugin repository for a patched release above version 2.7.1. As a compensating control, administrators should consider disabling the plugin on publicly accessible sites until a patch is available, which eliminates the attack surface entirely at the cost of losing booking/rental functionality. Alternatively, a Web Application Firewall (WAF) rule restricting unauthenticated POST requests to the plugin's specific AJAX or REST endpoints can reduce exploitation risk, though the precise endpoint identifier is not confirmed in available data. Patchstack's virtual patching service (Patchstack Protect) may provide a temporary rule for subscribers.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today