The Car Rental Manager plugin contains a missing authorization check that lets any authenticated user perform administrative actions on car rental data, which aligns with CWE-862. This flaw enables an attacker to create, modify, or delete listings and potentially access sensitive information stored in WordPress. The CVSS score of 6.5 reflects a moderate severity, underscoring the importance of correct authentication to contain the threat.

WordPress sites running the Car Rental Manager plugin version 1.5.3 or earlier are affected. The plugin is distributed by Magepeople inc. and any site that has not yet upgraded to 1.5.4 continues to expose this weakness.

The vulnerability is not listed in CISA KEV and no EPSS score is available, suggesting a low to moderate likelihood of exploitation in the field. Attackers would need a valid authenticated session on the WordPress site and would exploit the broken access control via the plugin’s administrative interface, typically through unauthenticated HTTP requests to endpoints that lack role checks. The effect is a compromise of confidentiality, integrity, and availability of the car rental data.