CVE-2026-57660
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Booking and Rental Manager plugin version 2.7.1 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to booking and rental management functions.
Risk Assessment
The risk involves potential unauthorized reading, modification, or deletion of booking data by unauthenticated users. This could lead to a breach of confidentiality and integrity of business data.
Recommendation
Immediately update the Booking and Rental Manager plugin to the latest available version. If an update is not possible, consider temporarily disabling the plugin until a patch is released.
Other vulnerabilities in Booking and Rental Manager
See all- CVE-2026-59532High
The Booking and Rental Manager plugin in version 2.7.2 and earlier has an unspecified vulnerability exploitable by an unauthenticated user. Technical details are unknown.
- CVE-2026-85303Medium
The Booking and Rental Manager WordPress plugin contains a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions from n/a through 2.7.7.
- CVE-2026-81762Medium
Broken Access Control vulnerability in Booking and Rental Manager up to version 2.7.6. Subscriber-level users can gain unauthorized access to functionality.
- CVE-2026-78257High
The Booking and Rental Manager plugin for WordPress versions up to 2.7.5 contains a PHP Object Injection vulnerability exploitable by users with the Contributor role.
- CVE-2026-78258Medium
Unauthenticated Broken Access Control vulnerability in Booking and Rental Manager versions up to 2.7.5. Allows unauthorized access to functions or data without authentication.
- CVE-2026-57404Medium
The Booking and Rental Manager plugin for WooCommerce has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.6.9.
Original NVD description (English source)
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS