What the vulnerability does
01Description
The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni' AJAX action in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve all booking records containing customers' personally identifiable information (PII), including names, email addresses, and phone numbers.
Explanation of Vulnerability in Simple Terms
02Summary
Simple Bike Rental versions 1.0.6 and earlier lack proper access controls, allowing authenticated users to read sensitive data they should not have access to. An attacker with a low-privilege account can view information restricted to other users or roles. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Read sensitive data belonging to other users or restricted to higher-privilege roles.
Potential impact on your site
04Site Impact
User data and role-based information may be exposed to unauthorized authenticated users.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege account on the site.
Key dates
06Disclosure timeline
December 12, 2025
CVE published
April 8, 2026
Record updated
