Booking And Rental Manager
Monthly
PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attackers to modify booking prices due to improper validation of input quantities (CWE-1284). The vulnerability enables remote attackers to alter pricing without authentication or user interaction, potentially leading to financial loss or fraudulent bookings. No evidence of active exploitation or publicly available exploit code exists at time of analysis.
Unauthenticated remote attackers can make limited unauthorized data modifications in Magepeople's Booking and Rental Manager for WooCommerce through version 2.8.2 because an access-control check is missing. The CVSS 5.3 rating reflects network reachability with no privileges or user interaction, but only low integrity impact and no confidentiality or availability impact. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated attackers can tamper with booking quantities in the Booking and Rental Manager WordPress plugin (versions through 2.8.0) due to improper validation of specified quantity input (CWE-1284), potentially removing important client functionality. The CVSS 5.3 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network-exploitable, low-complexity, unauthenticated access with integrity-only, partial impact and no confidentiality or availability effect. No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. No public exploit code has been identified at time of analysis, but the low privilege bar makes this attractive to any account-holding attacker on a WooCommerce-based rental or booking site.
Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) permits unauthenticated remote attackers to invoke restricted plugin functionality and read limited application data without any credentials. Rooted in CWE-862 (Missing Authorization), the flaw arises from absent capability checks on one or more plugin endpoints - a structural weakness common in WooCommerce extensions that register AJAX handlers or REST routes without verifying caller permissions. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at the time of analysis.
Missing authorization in the Booking and Rental Manager WordPress plugin (≤ 2.6.9) exposes unauthenticated remote attackers to broken access control, enabling unauthorized modification of booking data and partial disruption of plugin availability. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication or user interaction against any internet-facing WordPress/WooCommerce site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforwardly exploitable once a target is identified.
The Booking and Rental Manager plugin for WordPress through version 2.6.0 contains an authorization bypass that allows authenticated attackers to modify data they should not have access to. An attacker with low-privilege user credentials can exploit inadequately enforced access controls to perform unauthorized actions. No patch is currently available for this vulnerability.
PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.
Price manipulation in the Booking and Rental Manager WordPress plugin (versions <=2.7.2) allows unauthenticated attackers to modify booking prices due to improper validation of input quantities (CWE-1284). The vulnerability enables remote attackers to alter pricing without authentication or user interaction, potentially leading to financial loss or fraudulent bookings. No evidence of active exploitation or publicly available exploit code exists at time of analysis.
Unauthenticated remote attackers can make limited unauthorized data modifications in Magepeople's Booking and Rental Manager for WooCommerce through version 2.8.2 because an access-control check is missing. The CVSS 5.3 rating reflects network reachability with no privileges or user interaction, but only low integrity impact and no confidentiality or availability impact. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated attackers can tamper with booking quantities in the Booking and Rental Manager WordPress plugin (versions through 2.8.0) due to improper validation of specified quantity input (CWE-1284), potentially removing important client functionality. The CVSS 5.3 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network-exploitable, low-complexity, unauthenticated access with integrity-only, partial impact and no confidentiality or availability effect. No public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. No public exploit code has been identified at time of analysis, but the low privilege bar makes this attractive to any account-holding attacker on a WooCommerce-based rental or booking site.
Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) permits unauthenticated remote attackers to invoke restricted plugin functionality and read limited application data without any credentials. Rooted in CWE-862 (Missing Authorization), the flaw arises from absent capability checks on one or more plugin endpoints - a structural weakness common in WooCommerce extensions that register AJAX handlers or REST routes without verifying caller permissions. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at the time of analysis.
Missing authorization in the Booking and Rental Manager WordPress plugin (≤ 2.6.9) exposes unauthenticated remote attackers to broken access control, enabling unauthorized modification of booking data and partial disruption of plugin availability. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication or user interaction against any internet-facing WordPress/WooCommerce site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this straightforwardly exploitable once a target is identified.
The Booking and Rental Manager plugin for WordPress through version 2.6.0 contains an authorization bypass that allows authenticated attackers to modify data they should not have access to. An attacker with low-privilege user credentials can exploit inadequately enforced access controls to perform unauthorized actions. No patch is currently available for this vulnerability.