The vulnerability is an improper validation of user‑supplied quantity values in the Booking and Rental Manager plugin. Because the plugin accepts arbitrary quantity inputs, it can remove critical client functionality such as booking or rental records. The flaw is an example of input validation weakness, allowing attackers to manipulate functional behavior and potentially disable user access to core booking services.

The affected product is the Booking and Rental Manager plugin for WooCommerce from Magepeople inc. All releases up to and including version 2.8.0 are impacted.

The CVSS score of 5.3 signals a moderate impact, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack likely requires an attacker to submit crafted booking requests to the plugin’s input endpoint, exploiting the lack of quantity validation to alter or erase client data. The description does not explicitly state privilege escalation or remote code execution capabilities, and such outcomes are not within the scope of this vulnerability.