---
id: "CVE-2026-54850"
kind: "vulnerability"
aliases: ["CVE-2026-54850"]
title: "Booking and Rental Manager WordPress plugin: subscribers can bypass access control"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["booking-and-rental-manager", "package", "wordpress"]
not_affected_if: ["plugin-above-2.8.2", "plugin-not-installed"]
published_at: "2026-10-30T19:18:25+00:00"
first_seen_at: "2026-10-30T19:25:29+00:00"
updated_at: "2026-10-30T19:26:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54850", "first_seen_at": "2026-10-30T19:25:29+00:00"}]
---

# Booking and Rental Manager WordPress plugin: subscribers can bypass access control

The Booking and Rental Manager WordPress plugin, versions 2.8.2 and earlier, lets users with the Subscriber role reach functions they should not. The sources do not say exactly what data or actions are exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Booking and Rental Manager plugin in the WordPress admin Plugins screen against `2.8.2`

## Fix

- Move the Booking and Rental Manager plugin past `2.8.2`, the version range the source names as affected

## Timeline

- 2026-10-30T19:25:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54850

## From the sources

Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_