CVE-2026-27432

MediumCVSS 5.4

Published: 04/09/2026(UTC)Updated: 04/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Authorization Bypass Through User-Controlled Key vulnerability in WP Rentals by sc Internet Vivoo allows exploiting incorrectly configured access control security levels. Affects versions before 3.16.0.

Risk Assessment

Risk of unauthorized access to resources or functions, potentially leading to data breaches or unauthorized actions.

Recommendation

Update the WP Rentals plugin to version 3.16.0 or later, which includes a fix, and review authorization mechanisms.

Other vulnerabilities in WP Rentals

CVE-2026-27434Medium
The WP Rentals plugin (versions up to and including 3.14.2) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects WP Rentals from n/a through 3.14.2.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS