Description

Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-31T21:17:51.170Z",
  "pubdate": "2026-08-31T21:17:51.170Z",
  "executiveSummary": "The Booking and Rental Manager plugin, in versions 2.7.6 and below, is susceptible to a broken access control vulnerability.\nThis security flaw allows authenticated users with subscriber-level privileges to perform unauthorized actions or access sensitive administrative functionality within the plugin.\nThe vulnerability stems from improper authorization checks on server-side requests, failing to validate whether the requester possesses the necessary permissions to execute specific plugin operations.\nSuccessful exploitation enables an attacker to manipulate booking data, modify plugin settings, or perform other actions typically restricted to privileged users, such as administrators.\nThe vulnerability is critical as it leverages a legitimate, low-privilege authentication vector to facilitate unauthorized privilege escalation and data manipulation.\nNo complex exploitation requirements beyond basic authentication as a subscriber are necessary to trigger the vulnerability, posing a significant risk to the integrity and confidentiality of the booking management system.",
  "technicalDetails": "The vulnerability originates from inadequate capability checks within the plugin's action handling mechanisms. In Booking and Rental Manager versions 2.7.6 and below, the backend code fails to perform sufficient verification of the user's role and capabilities before executing administrative functions initiated by AJAX requests or direct HTTP POST requests.\nThe root cause resides in the lack of robust access control enforcement in the server-side controllers. When a subscriber interacts with specific endpoints responsible for plugin management, the application does not reliably enforce the 'manage_options' or equivalent high-privilege capabilities required for these operations.\nThe exploitation flow typically begins with an attacker authenticated as a subscriber. The attacker identifies the target API endpoint or the specific action parameter that triggers the intended administrative function. Because the backend code assumes the request is legitimate and lacks stringent authorization gates, the application processes the request as if it were authorized.\nAn attacker can craft a malicious HTTP request—often involving specific action parameters—designed to interact with the plugin’s sensitive backend logic. By submitting these crafted requests, the attacker can manipulate bookings, update rental availability, alter configuration settings, or potentially extract administrative data.\nThis vulnerability is particularly impactful because it breaks the fundamental security model that separates subscriber-level access from administrative capabilities. Since the application does not properly validate the session's privilege level against the requested action's required capability level, it effectively treats all authenticated subscribers as privileged users for these affected functions.\nThe network exposure is restricted to authenticated users; however, in many WordPress environments where subscriber registration is enabled, this barrier is minimal. The post-exploitation impact includes unauthorized modification of plugin data, potential disruption of booking services, and the risk of further system-wide compromise depending on the plugin's integration with the broader WordPress environment."
}