CVE-2026-27380
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
The Car Rental Manager plugin versions up to 1.3.9 have a PHP Object Injection vulnerability exploitable by users with the editor role. An attacker can exploit this to execute malicious code on the server.
Risk Assessment
Risk of remote code execution, potentially leading to full server compromise or data theft.
Recommendation
Update the Car Rental Manager plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Car Rental Manager
See all- CVE-2026-112825Medium
The Car Rental Manager plugin by Magepeople contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.5.3.
- CVE-2026-61985Medium
The Car Rental Manager WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.7.
- CVE-2025-69327Medium
Missing Authorization vulnerability in magepeopleteam Car Rental Manager allows exploiting incorrectly configured access control security levels. This issue affects Car Rental Manager from n/a through <= 1.0.9.
Original NVD description (English source)
Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS