CVE-2026-115614

The Booking and Rental Manager plugin in versions up to 2.8.2 contains a Broken Access Control vulnerability allowing a Subscriber-role user to perform unauthorized actions. This may lead to bypassing access controls on plugin functionality.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality. This issue affects Booking and Rental Manager: from n/a through 2.8.0.

The Booking and Rental Manager WordPress plugin contains a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions from n/a through 2.7.7.

Broken Access Control vulnerability in Booking and Rental Manager up to version 2.7.6. Subscriber-level users can gain unauthorized access to functionality.

The Booking and Rental Manager plugin for WordPress versions up to 2.7.5 contains a PHP Object Injection vulnerability exploitable by users with the Contributor role.

Unauthenticated Broken Access Control vulnerability in Booking and Rental Manager versions up to 2.7.5. Allows unauthorized access to functions or data without authentication.

The Booking and Rental Manager plugin in version 2.7.2 and earlier has an unspecified vulnerability exploitable by an unauthenticated user. Technical details are unknown.

The Booking and Rental Manager plugin for WooCommerce has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.6.9.

The Booking and Rental Manager plugin version 2.7.1 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to booking and rental management functions.