Car Rental Manager
Monthly
PHP Object Injection in the Car Rental Manager WordPress plugin (versions ≤ 1.3.9, by MagePeople Team) enables authenticated editor-level users to supply malicious serialized PHP payloads that are deserialized without validation, potentially triggering arbitrary code execution on the host server. The CVSS 7.2 score reflects the high-privilege prerequisite (PR:H), yet all three impact dimensions — confidentiality, integrity, and availability — score High, meaning successful exploitation can yield full environment compromise. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Missing authorization controls in the Car Rental Manager WordPress plugin (≤1.3.7) allow unauthenticated remote attackers to exploit incorrectly configured access control levels, resulting in limited integrity impact. The CVSS vector (PR:N/UI:N) confirms exploitation requires no credentials or user interaction against any publicly reachable WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world risk at a moderate level despite the trivial exploitation conditions.
PHP Object Injection in the Car Rental Manager WordPress plugin (versions ≤ 1.3.9, by MagePeople Team) enables authenticated editor-level users to supply malicious serialized PHP payloads that are deserialized without validation, potentially triggering arbitrary code execution on the host server. The CVSS 7.2 score reflects the high-privilege prerequisite (PR:H), yet all three impact dimensions — confidentiality, integrity, and availability — score High, meaning successful exploitation can yield full environment compromise. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Missing authorization controls in the Car Rental Manager WordPress plugin (≤1.3.7) allow unauthenticated remote attackers to exploit incorrectly configured access control levels, resulting in limited integrity impact. The CVSS vector (PR:N/UI:N) confirms exploitation requires no credentials or user interaction against any publicly reachable WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world risk at a moderate level despite the trivial exploitation conditions.