CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.9.
Explanation of Vulnerability in Simple Terms
The Booking and Rental Manager plugin for WordPress contains a missing authorization flaw that allows unauthenticated attackers to modify data on the site. An attacker can send network requests without authentication to alter bookings, rental settings, or other plugin data. This affects all versions up to 2.6.9. Site owners should update immediately to a version newer than 2.6.9.
What an attacker can do
Modify booking and rental data without logging in or having permission.
Potential impact on your site
Attackers can alter bookings, rental settings, and other plugin data without your knowledge or consent.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
