CVE-2022-36427 HIGH

CVE-2022-36427: WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability

Vendor About Rentals. Inc.

Product About Rentals (WordPress plugin)

Weakness CWE-264

Published September 6, 2022

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The About Rentals WordPress plugin version 1.5 and earlier contains a permissions vulnerability that allows unauthenticated attackers to read, modify, or delete data on the site. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update the plugin immediately to a patched version.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete site data without authentication.

Potential impact on your site

04Site Impact

Unauthorized users can access, alter, or remove rental listings, bookings, and other plugin data.

Conditions required to exploit

05Prerequisites

Network access to the WordPress site; no authentication or user interaction required.

Key dates

06Disclosure timeline

September 6, 2022 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-36427 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/264.html AskarLabs — CWE-264 write-up Permissions, Privileges, and Access Controls

Related vulnerabilities

Identifiers

CVE CVE-2022-36427

CWE CWE-264

CVSS 7.3 / HIGH

Affected versions