WordPress Plugin Vulnerabilities

Booking and Rental Manager < 2.7.0 - Missing Authorization

Description

The Booking and Rental Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.6.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
booking-and-rental-manager-for-woocommerce
Fixed in 2.7.0

References

CVE
CVE-2026-57404
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ed65eaa1-247e-4bb1-af72-d41962931826

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
hhhai
Verified
No
WPVDB ID
4f2da7e6-d9f0-4d56-8eeb-449d6c950b6e

Timeline

Publicly Published
2026-07-08 (about 1 month ago)
Added
2026-07-29 (about 26 days ago)
Last Updated
2026-07-29 (about 26 days ago)

Other

Published
Title
Published
2026-01-21
Title
TaxCloud for WooCommerce < 8.4.0 - Missing Authorization
Published
2024-07-08
Title
Product Designer < 1.0.34 - Unauthenticated Arbitrary Attachment Deletion
Published
2025-01-31
Title
Accessibility Suite by Ability, Inc < 4.19 - Missing Authorization
Published
2026-07-13
Title
Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization
Published
2024-01-17
Title
InstaWP Connect < 0.1.0.9 - Missing Authorization to Arbitrary Options Update