CVE-2026-115614: WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires no privileges, and needs no user interaction. An unauthenticated remote attacker may be able to exploit incorrectly configured access-control levels.

Q: What impact is indicated by the available severity data?

The supplied CVSS vector indicates integrity impact only, with no confidentiality or availability impact. The base severity is medium with a score of 5.3.

Q: Which plugin versions are affected?

The issue affects MagePeople Booking and Rental Manager through version 2.8.2. The affected version range begins at an unspecified earlier version.

Published Oct 26, 2026

Updated

Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.

Affected Software

1 affected component

MagePeople Booking and Rental Manager<=2.8.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/booking-and-rental-manager-for-woocommerce to a version that resolves this vulnerability.
Fixed in 2.8.3

Event History

Oct 26, 2026

CVE Published

via MITRE·10:05 AM

Data Sourced

via MITRE·10:05 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires no privileges, and needs no user interaction. An unauthenticated remote attacker may be able to exploit incorrectly configured access-control levels.

What impact is indicated by the available severity data?