Unauthenticated access control in the Booking and Rental Manager plugin prior to version 2.7.6 allows an attacker to bypass authentication checks and perform privileged actions, such as creating, editing, or deleting bookings and rental listings. This flaw can expose sensitive customer information and give an attacker control over booking data, potentially leading to data leakage or service disruption.

The vulnerability affects the WordPress Booking and Rental Manager plugin, version 2.7.5 and earlier, developed by Magepeople Inc. Sites running a WordPress installation with this plugin installed are at risk unless upgraded.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, so the likelihood of exploitation is unknown, but the flaw is unauthenticated and can be triggered by any user who can access the plugin URLs. The plugin is not listed in CISA KEV, yet the flaw still poses a real risk to site owners who have not updated.