CVE-2025-39390: Booking & Rental Manager Auth Bypass Flaw

CVE-2025-39390 Overview

CVE-2025-39390 is a missing authorization vulnerability [CWE-862] in the magepeopleteam Booking and Rental Manager plugin for WooCommerce. The flaw affects all plugin versions up to and including 2.3.6. Unauthenticated attackers can access functionality that is not properly constrained by access control lists (ACLs) over the network. The vulnerability requires no privileges and no user interaction. Exploitation impacts data integrity on affected WordPress sites running the plugin.

Critical Impact
Unauthenticated network-based attackers can invoke plugin functionality that should be restricted, leading to unauthorized modification of booking or rental data on affected WooCommerce sites.

Affected Products

magepeopleteam Booking and Rental Manager for WooCommerce
Versions from n/a through 2.3.6 (inclusive)
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-04-24 - CVE-2025-39390 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39390

Vulnerability Analysis

The Booking and Rental Manager plugin exposes one or more endpoints or actions that fail to enforce proper authorization checks. This is a broken access control weakness classified under [CWE-862] Missing Authorization. Attackers can reach protected functionality by sending crafted HTTP requests directly to WordPress AJAX handlers, REST endpoints, or admin-post routes registered by the plugin.

The issue affects functionality that should validate the caller's role or capability using WordPress functions such as current_user_can() or a valid nonce check via check_ajax_referer(). Because these checks are absent or incomplete, requests from unauthenticated visitors are processed as if they were authorized. The EPSS score for this vulnerability is 0.298%.

Root Cause

The root cause is the plugin's failure to verify the requester's permissions before executing sensitive operations. WordPress plugins commonly register callbacks through hooks such as wp_ajax_nopriv_*, wp_ajax_*, or rest_api_init. When these callbacks omit capability checks, any actor able to send an HTTP request can invoke them. In this plugin, at least one such handler executes actions that should be limited to administrators or authenticated store operators.

Attack Vector

Exploitation occurs remotely over HTTP or HTTPS. An attacker identifies the exposed AJAX action or REST route in the plugin's JavaScript or PHP source. The attacker then issues a direct POST or GET request to /wp-admin/admin-ajax.php or the corresponding REST endpoint. No authentication cookies, API keys, or user interaction are required. The vulnerability primarily impacts integrity, allowing unauthorized modification of plugin-managed data.

No public proof-of-concept exploit code is available. For technical details, see the Patchstack WordPress Vulnerability advisory.

Detection Methods for CVE-2025-39390

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with plugin-specific action parameters from unauthenticated sessions
Unusual modifications to booking, rental, or product metadata without a corresponding admin login event
Access to plugin REST routes under /wp-json/ from IP addresses that never authenticated to the site

Detection Strategies

Review WordPress and web server access logs for repeated requests to plugin endpoints without prior wp-login.php activity
Deploy a web application firewall rule that flags anonymous requests targeting plugin AJAX actions
Audit database changes in wp_posts, wp_postmeta, and plugin-specific tables for entries created or modified outside admin sessions

Monitoring Recommendations

Enable verbose logging for admin-ajax.php and REST API traffic on WooCommerce sites
Alert on high-frequency requests to any single AJAX action parameter from a single source IP
Correlate booking record changes with authenticated admin session identifiers to spot orphaned modifications

How to Mitigate CVE-2025-39390

Immediate Actions Required

Identify all WordPress sites running Booking and Rental Manager for WooCommerce version 2.3.6 or earlier
Update the plugin to a version above 2.3.6 once the vendor publishes a fix
If no patched version is available, deactivate and remove the plugin until a fix is released
Review booking and rental records for unauthorized changes made since deployment of the vulnerable version

Patch Information

At the time of this writing, no fixed version is documented in the referenced advisory beyond confirming that versions through 2.3.6 are affected. Administrators should monitor the Patchstack advisory and the plugin's WordPress.org listing for release notes indicating a security fix.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and plugin REST routes using a WAF or reverse proxy rule that blocks unauthenticated requests to the affected actions
Disable the plugin on internet-facing sites until a patched release is available
Apply IP allow-listing at the web server level for administrative endpoints where feasible

bash

# Example nginx rule to block unauthenticated access to a vulnerable AJAX action
# Replace <plugin_action_name> with the specific action identifier from the plugin
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^<plugin_action_name>$") {
        return 403;
    }
}