CVE-2026-57404
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Booking and Rental Manager plugin for WooCommerce has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.6.9.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or data, leading to a breach of confidentiality and integrity of the system.
Recommendation
It is recommended to immediately update the Booking and Rental Manager plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Booking and Rental Manager
See all- CVE-2026-78258Medium
Unauthenticated Broken Access Control vulnerability in Booking and Rental Manager versions up to 2.7.5. Allows unauthorized access to functions or data without authentication.
- CVE-2026-59532High
The Booking and Rental Manager plugin in version 2.7.2 and earlier has an unspecified vulnerability exploitable by an unauthenticated user. Technical details are unknown.
- CVE-2026-78257High
The Booking and Rental Manager plugin for WordPress versions up to 2.7.5 contains a PHP Object Injection vulnerability exploitable by users with the Contributor role.
- CVE-2026-57660Medium
The Booking and Rental Manager plugin version 2.7.1 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to booking and rental management functions.
Original NVD description (English source)
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.9.