CVE-2026-61985
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Car Rental Manager WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.7.
Risk Assessment
An attacker may gain unauthorized access to administrative functions or data, potentially leading to privilege escalation and system confidentiality breaches.
Recommendation
Immediately update the Car Rental Manager plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Car Rental Manager
See all- CVE-2026-112825Medium
The Car Rental Manager plugin by Magepeople contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.5.3.
- CVE-2026-27380High
The Car Rental Manager plugin versions up to 1.3.9 have a PHP Object Injection vulnerability exploitable by users with the editor role. An attacker can exploit this to execute malicious code on the server.
- CVE-2025-69327Medium
Missing Authorization vulnerability in magepeopleteam Car Rental Manager allows exploiting incorrectly configured access control security levels. This issue affects Car Rental Manager from n/a through <= 1.0.9.
Original NVD description (English source)
Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS