{"id":"CVE-2026-54850","kind":"vulnerability","aliases":["CVE-2026-54850"],"related":[],"title":"Booking and Rental Manager WordPress plugin: subscribers can bypass access control","description":"Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.","summary":"The Booking and Rental Manager WordPress plugin, versions 2.8.2 and earlier, lets users with the Subscriber role reach functions they should not. The sources do not say exactly what data or actions are exposed.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["booking-and-rental-manager","package","wordpress"],"not_affected_if":["plugin-above-2.8.2","plugin-not-installed"],"how_to_check":"- Check the installed version of the Booking and Rental Manager plugin in the WordPress admin Plugins screen against `2.8.2`","fix":"- Move the Booking and Rental Manager plugin past `2.8.2`, the version range the source names as affected","status":"open","published_at":"2026-10-30T19:18:25+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:26:14+00:00","updated_at":"2026-10-30T19:26:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:26:14Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Booking and Rental Manager plugin past `2.8.2`, the version range the source names as affected\n- unknown","reach":"internet","title":"Booking and Rental Manager WordPress plugin: subscribers can bypass access control","impact":"medium","summary":"The Booking and Rental Manager WordPress plugin, versions 2.8.2 and earlier, lets users with the Subscriber role reach functions they should not. The sources do not say exactly what data or actions are exposed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","booking-and-rental-manager"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"subscriber account reaches restricted plugin functions","analyst_note":"Check the NVD entry and the plugin changelog to find which functions are reachable and whether a fixed version exists.","how_to_check":"- Check the installed version of the Booking and Rental Manager plugin in the WordPress admin Plugins screen against `2.8.2`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-2.8.2"],"who_is_affected":"WordPress sites running the Booking and Rental Manager plugin at version 2.8.2 or earlier, where customers can register as Subscribers. Sites without this plugin are not affected. The sources do not say which functions are exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4057,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-54850':14A,17A '2.8.2':33B,68C 'access':10A,61C 'action':56B 'book':1A,19B,26B,64C 'booking-and-rental-manag':18B 'broken':60C 'bypass':9A 'control':11A,62C 'cve':12A,15A 'data':54B 'earlier':35B 'exact':52B 'expos':58B 'function':43B 'let':36B 'manag':4A,22B,29B,67C 'packag':23B 'plugin':6A,31B 'reach':42B 'rental':3A,21B,28B,66C 'role':41B 'say':51B 'sourc':48B 'subscrib':7A,40B,59C 'user':37B 'version':32B,69C 'wordpress':5A,24B,30B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Booking and Rental Manager plugin at version 2.8.2 or earlier, where customers can register as Subscribers. Sites without this plugin are not affected. The sources do not say which functions are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54850","severity":null,"published_at":"2026-10-30T19:18:25+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}