CVE-2026-61985
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Car Rental Manager WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.7.
Risk Assessment
An attacker may gain unauthorized access to administrative functions or data, potentially leading to privilege escalation and system confidentiality breaches.
Recommendation
Immediately update the Car Rental Manager plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Car Rental Manager
See all- CVE-2026-27380High
The Car Rental Manager plugin versions up to 1.3.9 have a PHP Object Injection vulnerability exploitable by users with the editor role. An attacker can exploit this to execute malicious code on the server.
- CVE-2025-69327Medium
Missing Authorization vulnerability in magepeopleteam Car Rental Manager allows exploiting incorrectly configured access control security levels. This issue affects Car Rental Manager from n/a through <= 1.0.9.
Original NVD description (English source)
Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS