Booking and Rental Manager EUVD-2026-68786

Exploitation requires a valid WordPress subscriber-level (or higher) account on the target site. This is the lowest authenticated role in WordPress, meaning any user who has completed the standard site registration flow qualifies. Sites with open user registration (the WooCommerce default to allow customer account creation) expose this vulnerability to any internet user who can complete a registration form. Sites that disable user registration or restrict it to admin-invited accounts significantly reduce the exploitable population. The CVSS vector confirms no user interaction is needed beyond the attacker's own authenticated session, and no special plugin configuration is required beyond having the plugin installed and active on a WooCommerce store.

The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N accurately represents the threat profile: network-reachable, low complexity, but requiring at minimum a subscriber account. The I:H rating is significant - an attacker can modify bookings or rental records, potentially disrupting business operations, creating fraudulent reservations, or canceling legitimate ones. No EPSS data was provided in the input, and the vulnerability is not in CISA KEV, suggesting exploitation has not been observed at scale. However, the low privilege bar (subscriber registration is often open on WooCommerce sites) means the effective attack surface is large on any public-facing deployment. Any operator running an open-registration rental or booking storefront - even a small one - should treat this as a priority patch rather than deferring it on the basis of medium severity alone. No confidentiality or availability impact is indicated, limiting the worst-case scenario to data integrity corruption rather than data exfiltration or service outage.

An attacker registers a free subscriber account on a WooCommerce site running the vulnerable plugin - a common configuration for rental and booking businesses that allow customer account creation. The attacker then sends crafted authenticated HTTP requests to the plugin's unprotected AJAX or REST handlers, invoking privileged booking-management functions to modify, cancel, or create reservations on behalf of other users. No public exploit code has been identified at time of analysis, but the straightforward nature of missing authorization checks makes independent rediscovery likely.