Live › vulnerability › CVE-2026-54850
The Booking and Rental Manager WordPress plugin, versions 2.8.2 and earlier, lets users with the Subscriber role reach functions they should not. The sources do not say exactly what data or actions are exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
WordPress sites running the Booking and Rental Manager plugin at version 2.8.2 or earlier, where customers can register as Subscribers. Sites without this plugin are not affected. The sources do not say which functions are exposed.
No product ranges from the sources yet.
2.8.22.8.2, the version range the source names as affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-54850")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.