CVE-2026-27380 HIGH

CVE-2026-27380: WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

Vendor Magepeopleteam
Product Car Rental Manager
Weakness CWE-502 · Unsafe deserialization
Published August 13, 2026
Last update August 13, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Car Rental Manager versions up to 1.3.9 contain a deserialization vulnerability that allows authenticated administrators to execute arbitrary code on the site. An attacker with admin privileges can craft malicious serialized data to trigger code execution. This requires high-level access but poses a critical risk if admin accounts are compromised or if untrusted administrators have access.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with full privileges.

Potential impact on your site

04Site Impact

A compromised admin account could lead to complete site takeover, data theft, or malware installation.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the site.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-65577 WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability CVE-2026-65581 WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field CVE-2026-49781 WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability CVE-2026-59521 WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability