{"id":"CVE-2026-112825","kind":"vulnerability","aliases":["CVE-2026-112825"],"related":[],"title":"Car Rental Manager WordPress plugin: missing authorization check through 1.5.3","description":"Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.","summary":"Car Rental Manager by Magepeople has a missing authorization check in versions through 1.5.3, so access control on some functions is not enforced as intended. The sources do not say exactly which actions an attacker can perform or with what level of access.","severity":"medium","cvss":6.5,"epss":0.00201,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["car-rental-manager","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Car Rental Manager plugin (`car-rental-manager`) in the WordPress admin plugin list or the plugin header in `wp-content/plugins/car-rental-manager/`\n- unknown for any other detection method","fix":"- Update Car Rental Manager to a version later than `1.5.3` once the vendor publishes one; the sources do not name a fixed version\n- unknown for other mitigations","status":"open","published_at":"2026-10-23T09:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:47:19+00:00","updated_at":"2026-10-25T03:47:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:47:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update Car Rental Manager to a version later than `1.5.3` once the vendor publishes one; the sources do not name a fixed version\n- unknown for other mitigations","reach":"internet","title":"Car Rental Manager WordPress plugin: missing authorization check through 1.5.3","impact":"medium","summary":"Car Rental Manager by Magepeople has a missing authorization check in versions through 1.5.3, so access control on some functions is not enforced as intended. The sources do not say exactly which actions an attacker can perform or with what level of access.","category":"package","nicknames":[],"who_cares":["wordpress","car-rental-manager","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin functions","analyst_note":"Find the vendor advisory or Wordfence/WPScan entry for CVE-2026-112825 to learn which endpoint lacks the check, the required role, and the fixed version.","how_to_check":"- Check the installed version of the Car Rental Manager plugin (`car-rental-manager`) in the WordPress admin plugin list or the plugin header in `wp-content/plugins/car-rental-manager/`\n- unknown for any other detection method","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Car Rental Manager plugin at version 1.5.3 or earlier are in scope. Sites that do not have this plugin installed are not affected. The sources do not say which roles or configurations are required to reach the flawed function.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3328,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112825':13A,16A '-2026':12A,15A '1.5.3':10A,39B,98C 'access':41B,68B,86C 'action':58B 'affect':91C 'allow':82C 'attack':60B 'author':7A,34B,70C 'car':1A,18B,26B,75C,79C,92C 'car-rental-manag':17B,78C 'check':8A,35B 'configur':85C 'control':42B,87C 'cve':11A,14A 'enforc':48B 'exact':56B 'exploit':83C 'function':45B 'host':24B 'inc':74C 'incorrect':84C 'intend':50B 'issu':90C 'level':66B 'levels.this':89C 'magepeopl':30B,73C 'manag':3A,20B,28B,77C,81C,94C 'miss':6A,33B,69C 'n/a':96C 'packag':21B 'perform':62B 'plugin':5A 'rental':2A,19B,27B,76C,80C,93C 'say':55B 'secur':88C 'self':23B 'self-host':22B 'sourc':52B 'version':37B 'vulner':71C 'wordpress':4A,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Car Rental Manager plugin at version 1.5.3 or earlier are in scope. Sites that do not have this plugin installed are not affected. The sources do not say which roles or configurations are required to reach the flawed function.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112825","severity":null,"published_at":"2026-10-23T09:17:05+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112825","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112825","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}