The vulnerability is a missing authorization flaw in the Booking and Rental Manager plugin for WooCommerce. It allows an attacker to bypass the standard access control checks defined by the plugin and perform actions intended only for privileged users. This could enable unauthorized manipulation of booking records, viewing of sensitive customer information, or other privileged operations. The flaw corresponds to CWE‑862, indicating an authorization error.

This issue affects the Booking and Rental Manager plugin, developed by magepeopleteam, for all WordPress sites running the plugin through version 2.6.0. Any site using these versions is vulnerable until the plugin is updated.

The CVSS score of 6.5 indicates a moderate risk. The EPSS score below 1% suggests that exploitation is unlikely but still possible, especially in high‑value target configurations. The problem is not listed in the CISA KEV catalog, indicating there are no known large‑scale attacks at this time. The most probable attack vector is a web request to a plugin endpoint that lacks proper authorization checks; an attacker who can reach the plugin, even as a non‑administrator, may exploit the flaw.