MEDIUM

CVE-2026-57660

2026-06-26 CVSS v3.1

CVSS

5.3

Description

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

Summary dbcve.org

Unauthenticated Broken Access Control vulnerability in Booking and Rental Manager plugin for WordPress allows unauthenticated attackers to access functionality or data that should require authentication. The vulnerability affects versions 2.7.1 and below.

Mitigation

Update Booking and Rental Manager to the latest version once a patch is released. If no patch is available, consider disabling the plugin until a secure version can be implemented, and restrict plugin admin pages at the web server level as a temporary measure.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.29%

Probability of exploitation in next 30 days

22.2th percentile

References

https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-7-1-broken-access-control-vulnerability?_s_id=cve

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE