CVE-2026-115614 in Booking and Rental Manager Plugin
Summary
by MITRE • 10/26/2026
Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified security flaw resides within the Booking and Rental Manager plugin for WooCommerce, developed by Magepeople Inc., specifically affecting versions ranging from the initial release up to version 2.8.2. This vulnerability is classified as a missing authorization issue, which fundamentally represents an improper implementation of access control mechanisms on the server side. In web application security, proper authentication verifies the identity of a user, while authorization determines what that authenticated user is permitted to do. The flaw in this plugin indicates that certain administrative or sensitive operations can be executed by users who lack the necessary privileges, effectively bypassing the intended role-based restrictions designed to protect site integrity and data confidentiality.
From a technical perspective, this vulnerability allows an attacker with low-privileged access, such as a subscriber or customer account, to perform actions reserved for higher-level roles like administrators or shop managers. This typically occurs because the application fails to verify the user's permissions before processing specific requests related to booking configurations, rental settings, or administrative data manipulation. The server processes these requests based solely on the presence of valid session cookies or tokens without cross-referencing them against a robust access control list. Consequently, an attacker can craft malicious HTTP requests that interact with endpoints intended for privileged users, leading to unauthorized modifications of site configuration, creation of fraudulent bookings, or potential data exfiltration depending on the specific functions exposed by this flaw.
The operational impact of this vulnerability is significant for any e-commerce website relying on WooCommerce and this particular plugin. Attackers can disrupt business operations by creating invalid rental agreements, altering pricing structures, or deleting critical booking records. Furthermore, if the vulnerable endpoints allow access to sensitive customer data or administrative settings, it could lead to a broader compromise of the web application environment. This lack of enforcement in security levels undermines the trust model of the platform and exposes the organization to risks associated with incorrect configuration of access control policies, potentially leading to regulatory non-compliance depending on the nature of the exposed data.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) ID 284, which describes Improper Access Control, specifically falling under scenarios where a user is able to bypass intended restrictions without proper authorization checks. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1078, Valid Accounts, particularly when leveraged by lower-privileged users attempting to escalate their privileges or access resources outside their scope. It also relates to the broader category of Broken Access Control within the OWASP Top 10 for web application security, highlighting a critical failure in enforcing policy boundaries between different user roles.
To mitigate this risk, site administrators must immediately update the Booking and Rental Manager plugin to version 2.8.3 or later, where these authorization checks have been corrected by the vendor. Until an upgrade is feasible, implementing strict Web Application Firewall rules can help block suspicious requests that attempt to access administrative endpoints with non-admin credentials. Additionally, organizations should review their server-side logging mechanisms to detect anomalous activity patterns indicative of privilege escalation attempts and ensure that all third-party plugins are regularly audited for compliance with current security standards.