CVE-2026-8690
Description
The RentMy Real-Time Rental Management Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, and delete event records stored in the rentmy_events WordPress option, as well as overwrite the rentmy_locationId option.
Summary dbcve.org
The RentMy Real-Time Rental Management Plugin for WordPress fails to perform proper authorization checks on functions that handle the rentmy_events and rentmy_locationId WordPress options. This allows any unauthenticated user to read, create, update, and delete event records and overwrite the location ID setting without any authentication or capability verification.
Mitigation
Update to version 4.0.5 or later if available. If no patch exists, disable the plugin until a secure version is released. Alternatively, restrict access to the affected endpoints at the web server level.