Vulnerability feed

Executive summary

A broken access control flaw in the Car Rental Manager WordPress plugin, made by Magepeople inc, lets low-privileged users reach actions they should not be able to perform. The advisory rates it medium severity with a CVSS score of 6.5 and says it is expected to be exploited. The vendor recommends updating the plugin to version 1.5.4 or later.

Technical summary

The vulnerability is a missing authorization or broken access control issue, classified as OWASP A1. The advisory states that versions 1.5.3 and earlier are vulnerable and that version 1.5.4 is patched. The required privilege is Subscriber, so an authenticated low-privileged account is the precondition for exploitation. The advisory says no mitigation rule can be assigned, so a virtual patch is not available, and it gives no other workaround beyond updating or asking a host or developer for help. Exploitation in the wild is not confirmed, though the advisory says it is expected to be exploited. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affects

Magepeople inc.Magepeople inc. Car Rental Manager