The RentMy Real-Time Rental Management Plugin is vulnerable to a missing authorization check. An unauthenticated user can perform actions that should require proper credentials, such as reading, creating, updating, or deleting event records in the rentmy_events option and overwriting the rentmy_locationId option. This flaw arises from the plugin’s failure to verify user permissions before processing the rentmy_cdn_request AJAX request, effectively leaking the CWE-862 weakness.

The vulnerability applies to the RentMy Real-Time Rental Management Plugin, WordPress, for all releases up to and including 4.0.4.1. Administrators of sites running any of these versions are potentially exposed to unauthorized configuration changes and manipulation of rental event data.

The CVSS score of 5.3 indicates moderate severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation. Attackers can exploit this flaw by making unauthenticated AJAX requests to the rentmy_cdn_request action. Because the plugin has no permission checks for this action, an attacker does not need authentication to read or modify event data and configuration options. The lack of authentication demands minimal effort, making exploitation relatively straightforward for those with basic web knowledge.