CVE-2026-78258: Booking and Rental Manager Auth Bypass Flaw

CVE-2026-78258 Overview

CVE-2026-78258 is an unauthenticated broken access control vulnerability in the Booking and Rental Manager for WooCommerce WordPress plugin. All versions up to and including 2.7.5 are affected. The flaw is categorized under [CWE-862] Missing Authorization. Remote attackers can reach protected functionality over the network without authentication or user interaction. Successful exploitation results in limited confidentiality impact, exposing data that should be restricted to authorized users.

Critical Impact
Unauthenticated network attackers can bypass access controls in the Booking and Rental Manager plugin (≤ 2.7.5) to read data intended for authorized users only.

Affected Products

Booking and Rental Manager for WooCommerce (WordPress plugin)
Versions 2.7.5 and earlier
WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

2026-08-24 - CVE-2026-78258 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78258

Vulnerability Analysis

The vulnerability is a Broken Access Control weakness classified as [CWE-862] Missing Authorization. The plugin exposes one or more endpoints that fail to verify whether the requester holds the required capability or role. An unauthenticated remote attacker can reach these endpoints directly over HTTP and retrieve information that should be gated behind authentication.

The impact is limited to confidentiality. Integrity and availability of the WordPress installation are not directly affected by this issue. However, disclosed data can support follow-on attacks such as targeted phishing, account enumeration, or reconnaissance against the booking system.

Root Cause

The root cause is a missing authorization check on plugin functionality. WordPress plugins typically enforce access using current_user_can(), capability checks, or nonce verification through check_ajax_referer(). In vulnerable Booking and Rental Manager builds, at least one handler executes its logic without validating the caller's identity or privileges.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the exposed plugin endpoint. The server processes the request and returns data that should be protected. Refer to the Patchstack Vulnerability Report for endpoint-specific details.

No public proof-of-concept exploit is currently listed for this CVE, and it is not present in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.187%.

Detection Methods for CVE-2026-78258

Indicators of Compromise

Unauthenticated HTTP requests to Booking and Rental Manager plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ returning non-empty response bodies
Anomalous outbound data volume from wp-content/plugins/booking-and-rental-manager-for-woocommerce/ handlers
Requests originating from single IP addresses enumerating booking IDs, customer records, or reservation parameters

Detection Strategies

Review WordPress and web server access logs for repeated requests to plugin AJAX actions or REST routes without valid session cookies or nonces
Alert on HTTP 200 responses returned to unauthenticated clients calling plugin endpoints that historically required authentication
Correlate scraping patterns such as sequential ID iteration against booking-related URIs

Monitoring Recommendations

Enable verbose access logging on the WordPress front end and preserve logs for at least 90 days
Deploy a Web Application Firewall (WAF) with virtual patching rules for known WordPress plugin CVEs
Monitor plugin update status across all WordPress installations and flag sites still running Booking and Rental Manager 2.7.5 or earlier

How to Mitigate CVE-2026-78258

Immediate Actions Required

Identify all WordPress sites running the Booking and Rental Manager for WooCommerce plugin and confirm the installed version
Upgrade the plugin to a version later than 2.7.5 as soon as the vendor publishes a fixed release
Restrict access to /wp-admin/admin-ajax.php and /wp-json/ for the affected plugin using WAF rules until a patch is applied
Review access logs for signs of prior unauthenticated data retrieval

Patch Information

Consult the Patchstack Vulnerability Report for the current patch status. Apply the vendor update through the WordPress plugin manager once available, then verify the running version in wp-admin > Plugins.

Workarounds

Deactivate the Booking and Rental Manager plugin on production sites until a fixed version is installed
Deploy WAF rules that block unauthenticated requests to the vulnerable plugin endpoints
Enforce IP allow-listing for administrative and booking management URIs where feasible
Rotate any credentials or tokens that may have appeared in disclosed booking data

bash

# Example: block unauthenticated access to the plugin directory via .htaccess
<FilesMatch "^.*\.(php)$">
  Require valid-user
</FilesMatch>

# Example: WP-CLI check for installed plugin version
wp plugin get booking-and-rental-manager-for-woocommerce --field=version