CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.
Explanation of Vulnerability in Simple Terms
The Booking and Rental Manager plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to read sensitive data they should not access. An attacker with a standard user account can retrieve confidential information by making direct requests to the plugin. This affects all versions up to and including 2.6.0.
What an attacker can do
Read sensitive data belonging to other users or the site without proper authorization.
Potential impact on your site
Customer data, booking details, or other confidential information may be exposed to unauthorized users with site accounts.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., customer or subscriber role) on the site.
Key dates
External resources
Related vulnerabilities
