CVE-2026-112825
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Car Rental Manager plugin by Magepeople contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.5.3.
Risk Assessment
An attacker may perform unauthorized actions in the car rental system, potentially leading to data modification or unauthorized access. This may compromise data integrity and confidentiality.
Recommendation
Update the Car Rental Manager plugin to a version later than 1.5.3 if available, or implement additional access controls. Review user permissions and roles in the system.
Other vulnerabilities in Car Rental Manager
See all- CVE-2026-27380High
The Car Rental Manager plugin versions up to 1.3.9 have a PHP Object Injection vulnerability exploitable by users with the editor role. An attacker can exploit this to execute malicious code on the server.
- CVE-2026-61985Medium
The Car Rental Manager WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.7.
- CVE-2025-69327Medium
Missing Authorization vulnerability in magepeopleteam Car Rental Manager allows exploiting incorrectly configured access control security levels. This issue affects Car Rental Manager from n/a through <= 1.0.9.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS