CVE-2026-23972

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23972", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-19T16:14:52.936Z", "datePublished": "2026-03-25T16:14:30.153Z", "dateUpdated": "2026-04-28T16:14:47.260Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "booking-and-rental-manager-for-woocommerce", "product": "Booking and Rental Manager", "vendor": "magepeopleteam", "versions": [{"changes": [{"at": "2.6.1", "status": "unaffected"}], "lessThanOrEqual": "2.6.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "PPzzAArr | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:18:29.981Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.</p>"}], "value": "Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:47.260Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-6-0-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T16:45:17.279132Z", "id": "CVE-2026-23972", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T15:48:00.444Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23972", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T16:45:17.279132Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T16:32:38.710Z"}}], "cna": {"title": "WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "PPzzAArr | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "magepeopleteam", "product": "Booking and Rental Manager", "versions": [{"status": "affected", "changes": [{"at": "2.6.1", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2.6.0"}], "packageName": "booking-and-rental-manager-for-woocommerce", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:18:29.981Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-6-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:03.979Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23972", "state": "PUBLISHED", "dateUpdated": "2026-04-28T15:48:00.444Z", "dateReserved": "2026-01-19T16:14:52.936Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:30.153Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "booking-and-rental-manager-for-woocommerce", "product": "Booking and Rental Manager", "vendor": "magepeopleteam", "versions": [{"changes": [{"at": "2.6.1", "status": "unaffected"}], "lessThanOrEqual": "2.6.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0."}, {"lang": "es", "value": "Vulnerabilidad por falta de autorizaci\u00f3n en magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Booking and Rental Manager: desde n/a hasta &lt;= 2.6.0."}], "id": "CVE-2026-23972", "lastModified": "2026-06-17T10:22:22.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23972", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T16:45:17.279132Z", "version": "2.0.3"}}]}, "published": "2026-03-25T17:16:36.280", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-6-0-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[2.6.1,*]"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "Booking and Rental Manager", "source": "cna", "vendor": "magepeopleteam"}, "product": "booking_&_rental_manager", "vendor": "magepeople"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-26T18:49:27.058727+00:00", "value": {"mitigation_remediation": ["Upgrade the Booking and Rental Manager plugin to the latest available version (2.6.1 or newer).", "If updating is not immediately possible, restrict access to the plugin\u2019s booking and rental pages so that only users with administrator privileges can reach them, using role\u2011based access control or a security plugin.", "Review and re\u2011configure the plugin\u2019s built-in security settings to ensure correct permissions are enforced.", "After applying a patch or configuration change, test the plugin to verify that unauthorized actions are no longer possible."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "This issue affects the Booking and Rental Manager plugin, developed by magepeopleteam, for all WordPress sites running the plugin through version 2.6.0. Any site using these versions is vulnerable until the plugin is updated.", "description_and_impact": "The vulnerability is a missing authorization flaw in the Booking and Rental Manager plugin for WooCommerce. It allows an attacker to bypass the standard access control checks defined by the plugin and perform actions intended only for privileged users. This could enable unauthorized manipulation of booking records, viewing of sensitive customer information, or other privileged operations. The flaw corresponds to CWE\u2011862, indicating an authorization error.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate risk. The EPSS score below 1% suggests that exploitation is unlikely but still possible, especially in high\u2011value target configurations. The problem is not listed in the CISA KEV catalog, indicating there are no known large\u2011scale attacks at this time. The most probable attack vector is a web request to a plugin endpoint that lacks proper authorization checks; an attacker who can reach the plugin, even as a non\u2011administrator, may exploit the flaw."}}}}, "created": "2026-03-25T21:34:57.541512+00:00", "updated": "2026-03-27T09:46:33.313592+00:00", "vendors": ["magepeople", "magepeople$PRODUCT$booking_&_rental_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}