WP Rentals EUVD-2026-94260

Exploitation requires only that a target site runs the WP Rentals (wprentals) theme at version 3.14.2 or earlier; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no special configuration, and no user interaction are needed, so default installations are affected. The limiting factor is the narrow impact: only a Low integrity effect (C:N/A:N), meaning an attacker can perform an unauthorized state-changing action but cannot read sensitive data or disrupt availability through this flaw alone. The specific feature/endpoint lacking the authorization check is not named in the available description, so defenders cannot scope the exact affected function without the vendor advisory.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N) reflects a network-reachable, low-complexity, unauthenticated flaw, but the impact is deliberately narrow: only a Low integrity impact (I:L) with no confidentiality (C:N) or availability (A:N) effect. CWE-862 (Missing Authorization) combined with the 'Broken Access Control' / 'Authentication Bypass' framing indicates an attacker can invoke an action or modify state they should not be authorized for, rather than read sensitive data or take over the site. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or widespread exploitation - the signals are internally consistent (modest score, no exploitation intelligence) and do not conflict. The main driver of real-world risk is the PR:N/AC:L combination (easy to script once a payload is known), tempered by the low impact ceiling. Priority should be patch-on-normal-cycle unless the affected theme is internet-facing on a high-value rental site.

An unauthenticated remote attacker sends a crafted HTTP request to a WP Rentals endpoint that fails to verify the caller's authorization, invoking a privileged action or altering data the attacker should not be able to change. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the request can be issued directly against any reachable site running WP Rentals ≤ 3.14.2. No public exploit code was identified at the time of analysis.