CVE-2026-27434

MediumCVSS 5.3

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

The WP Rentals plugin (versions up to and including 3.14.2) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects WP Rentals from n/a through 3.14.2.

Risk Assessment

An attacker could perform operations or access data without the required permissions, potentially leading to unauthorized changes to listings or disclosure of user data.

Recommendation

Update the WP Rentals plugin to a version later than 3.14.2 that fixes the vulnerability. Verify WordPress role permissions.

Other vulnerabilities in WP Rentals

CVE-2026-27432Medium
Authorization Bypass Through User-Controlled Key vulnerability in WP Rentals by sc Internet Vivoo allows exploiting incorrectly configured access control security levels. Affects versions before 3.16.0.

Original NVD description (English source)

Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS