CVE-2026-8690: RentMy WordPress Auth Bypass Vulnerability

CVE-2026-8690 Overview

CVE-2026-8690 is an authorization bypass vulnerability in the RentMy Real-Time Rental Management Plugin for WordPress. The flaw affects all plugin versions up to and including 4.0.4.1. The plugin fails to verify whether a user is authorized to invoke several AJAX actions exposed by class-rentmy-ajax.php. Unauthenticated attackers can read, create, update, and delete event records stored in the rentmy_events WordPress option. Attackers can also overwrite the rentmy_locationId option, altering the plugin's configured location identifier. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated attackers can tamper with rental event data and overwrite the plugin's location identifier on any vulnerable WordPress site, undermining the integrity of the rental management workflow.

Affected Products

RentMy Real-Time Rental Management Plugin for WordPress, all versions up to and including 4.0.4.1
WordPress sites running the rentmy-online-rental-shop plugin
WordPress installations using the rentmy_events and rentmy_locationId options

Discovery Timeline

2026-06-24 - CVE-2026-8690 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-8690

Vulnerability Analysis

The RentMy plugin registers several AJAX endpoints inside includes/class-rentmy-ajax.php that operate on WordPress options used to persist rental events and the active location identifier. The handlers at lines 16, 53, 73, and 83 of that file execute their read and write logic without performing capability checks or nonce verification. As a result, anyone who can send an HTTP request to admin-ajax.php can trigger the vulnerable actions.

The issue is a classic missing authorization flaw rather than a code execution or memory corruption bug. Confidentiality is not directly affected because the data exposed is limited to plugin-managed rental events. Integrity, however, is reduced because attackers can overwrite or delete records stored in WordPress options.

Root Cause

The root cause is the absence of current_user_can() capability checks and check_ajax_referer() nonce validation in the AJAX handlers. The plugin treats both wp_ajax_ and wp_ajax_nopriv_ hooks as equally trusted. This pattern violates the principle of least privilege and falls under CWE-862.

Attack Vector

An attacker sends crafted POST requests to the site's wp-admin/admin-ajax.php endpoint, specifying the vulnerable RentMy action parameters. Because no authentication, role, or nonce check is enforced, the requests succeed from an unauthenticated context over the network. The attacker can then enumerate events stored in the rentmy_events option, insert or delete events, and overwrite the rentmy_locationId option to change the plugin's logical location binding. Technical references are available in the Wordfence Vulnerability Report and the WordPress Plugin Code Review.

Detection Methods for CVE-2026-8690

Indicators of Compromise

Unexpected entries, modifications, or deletions in the rentmy_events WordPress option
Unauthorized changes to the rentmy_locationId value
POST requests to /wp-admin/admin-ajax.php containing RentMy-related action parameters from unauthenticated sessions
Access log entries showing repeated AJAX calls without a valid wordpress_logged_in_* cookie

Detection Strategies

Inspect web server access logs for admin-ajax.php requests that target RentMy actions and lack authenticated session cookies
Periodically diff the rentmy_events and rentmy_locationId options against a known-good baseline
Enable WordPress audit logging to capture option updates triggered outside of administrator sessions

Monitoring Recommendations

Alert on bursts of admin-ajax.php POST requests from a single IP address with no prior login activity
Forward WordPress and web server logs to a centralized SIEM and watch for changes to plugin-managed options
Track plugin version inventory so that any RentMy installation at or below version 4.0.4.1 is flagged for remediation

How to Mitigate CVE-2026-8690

Immediate Actions Required

Identify all WordPress sites running the rentmy-online-rental-shop plugin and confirm the installed version
Update the RentMy Real-Time Rental Management Plugin to a version newer than 4.0.4.1 once the vendor publishes a fix
If no patch is available, deactivate and remove the plugin until a fixed release is confirmed
Restore the rentmy_events and rentmy_locationId options from a clean backup if tampering is suspected

Patch Information

At the time of publication, no fixed version was listed in the NVD entry beyond the affected ceiling of 4.0.4.1. Monitor the Wordfence Vulnerability Report and the official plugin page for an updated release that adds capability and nonce checks to the AJAX handlers in class-rentmy-ajax.php.

Workarounds

Block unauthenticated POST requests to admin-ajax.php that target RentMy actions using a web application firewall rule
Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible, while preserving required front-end functionality
Temporarily disable the plugin on production sites that do not actively rely on RentMy AJAX features

bash

# Example ModSecurity rule to block unauthenticated RentMy AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,id:1026869001,phase:2,deny,status:403,log,msg:'Block unauthenticated RentMy AJAX action (CVE-2026-8690)'"
    SecRule ARGS:action "@rx ^rentmy_" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"