WordPress Plugin Vulnerabilities

Booking and Rental Manager for Bike < 2.7.3 - Unauthenticated Price Maniputlation

Description

The plugin is vulnerable to price manipulation. This makes it possible for unauthenticated attackers to alter the price of bookings.

Affects Plugins

Plugin icon
booking-and-rental-manager-for-woocommerce
Fixed in 2.7.3

References

CVE
CVE-2026-59532
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/95d85e42-4872-4fc4-9e6f-4b9d9fb75ef2

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
619a30bd-f026-4b05-90aa-d999021b6528

Timeline

Publicly Published
2026-07-23 (about 1 month ago)
Added
2026-07-29 (about 27 days ago)
Last Updated
2026-07-29 (about 27 days ago)

Other

Published
Title
Published
2024-04-22
Title
ProfileGrid – User Profiles, Memberships, Groups and Communities < 5.8.0 - Insecure Direct Object Reference
Published
2025-02-21
Title
Post Grid and Gutenberg Blocks < 2.3.6 - Unauthenticated Paid Order Creation
Published
2024-10-16
Title
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin < 1.0.26 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover
Published
2024-05-30
Title
Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
Published
2026-07-08
Title
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration < 4.3.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter