Live › vulnerability › CVE-2026-112825
Go to dashboardCar Rental Manager by Magepeople has a missing authorization check in versions through 1.5.3, so access control on some functions is not enforced as intended. The sources do not say exactly which actions an attacker can perform or with what level of access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Car Rental Manager plugin at version 1.5.3 or earlier are in scope. Sites that do not have this plugin installed are not affected. The sources do not say which roles or configurations are required to reach the flawed function.
No product ranges from the sources yet.
car-rental-manager) in the WordPress admin plugin list or the plugin header in wp-content/plugins/car-rental-manager/1.5.3 once the vendor publishes one; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-112825")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.