Ownerrez Api
Monthly
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.