The Simple Bike Rental WordPress plugin suffers from a missing capability check on the 'simpbire_carica_prenotazioni' AJAX endpoint. Because the check is absent, any user with Subscriber or higher privileges can invoke the action and obtain the entire set of booking records. The data includes customers’ names, email addresses, and phone numbers, meaning the vulnerability allows the disclosure of personally identifiable information. The weakness corresponds to CWE‑862, representing insufficient authorization, and it does not alter the integrity or availability of the system, only its confidentiality.

The flaw affects the Simple Bike Rental plugin developed by rodolforizzo76, for all released versions up to and including 1.0.6. Users running any of these versions in a WordPress installation are susceptible, regardless of the website’s configuration or other plugins.

The CVSS base score is 4.3, indicating a medium confidentiality impact but no authentication or authorization prerequisites beyond normal subscription levels. The EPSS score of less than 1% suggests the vulnerability is rarely exploited in the wild. It is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with at least Subscriber permissions who can call the exposed AJAX action, implying the threat is limited to individuals who have logged into the WordPress site or obtained credentials for a user of that level.