PT-2026-51685 · WordPress · Rentmy Real-Time Rental Management Plugin
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
RentMy Real-Time Rental Management Plugin versions prior to 4.0.4.2
Description
An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to read, create, update, and delete event records stored in the
rentmy events WordPress option and overwrite the rentmy locationId option.Recommendations
Update the plugin to version 4.0.4.2 or later.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rentmy Real-Time Rental Management Plugin