CVE-2026-8690

Name of the Vulnerable Software and Affected Versions RentMy Real-Time Rental Management Plugin versions prior to 4.0.4.2

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to read, create, update, and delete event records stored in the rentmy events WordPress option and overwrite the rentmy locationId option.

Recommendations Update the plugin to version 4.0.4.2 or later.