---
id: "CVE-2026-112825"
kind: "vulnerability"
aliases: ["CVE-2026-112825"]
title: "Car Rental Manager WordPress plugin: missing authorization check through 1.5.3"
severity: "medium"
cvss: 6.5
epss: 0.00201
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["car-rental-manager", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-23T09:17:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:47:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112825", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112825", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Car Rental Manager WordPress plugin: missing authorization check through 1.5.3

Car Rental Manager by Magepeople has a missing authorization check in versions through 1.5.3, so access control on some functions is not enforced as intended. The sources do not say exactly which actions an attacker can perform or with what level of access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Car Rental Manager plugin (`car-rental-manager`) in the WordPress admin plugin list or the plugin header in `wp-content/plugins/car-rental-manager/`
- unknown for any other detection method

## Fix

- Update Car Rental Manager to a version later than `1.5.3` once the vendor publishes one; the sources do not name a fixed version
- unknown for other mitigations

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112825
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112825

## From the sources

Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_