PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-57660 magepeopleteam CVE debrief

CVE-2026-57660 is a medium-severity vulnerability in the Booking and Rental Manager plugin for WordPress, versions up to 2.7.1. The vulnerability allows unauthenticated broken access control, potentially enabling attackers to access sensitive information or perform unauthorized actions. The CVSS score for this vulnerability is 5.3, indicating a medium severity level. The vulnerability was published on June 26, 2026, and last modified on June 29, 2026. The vendor and product information is not confirmed, with the canonical source listed as 'reference_domain_weak' and confidence level as 'low'.

Vendor
magepeopleteam
Product
Booking and Rental Manager
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Administrators and users of the Booking and Rental Manager plugin for WordPress, version 2.7.1 or earlier, should be aware of this vulnerability and take necessary actions to mitigate the risk. This vulnerability could potentially allow unauthorized access to sensitive information or enable attackers to perform malicious actions. Users should check their plugin versions and update to a patched version as soon as possible.

Technical summary

The vulnerability is caused by unauthenticated broken access control in the Booking and Rental Manager plugin for WordPress, versions up to 2.7.1. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that the vulnerability can be exploited over the network with low attack complexity and no privileges required. The vulnerability allows attackers to perform unauthorized actions, potentially leading to data breaches or other security incidents.

Defensive priority

Medium priority should be given to patching this vulnerability, as it allows unauthenticated broken access control and has a medium CVSS score. Administrators should prioritize patching this vulnerability, especially if the plugin is used in a sensitive environment or has a high attack surface.

Recommended defensive actions

  • Update the Booking and Rental Manager plugin to a patched version as soon as possible.
  • Review and monitor plugin usage and access controls to prevent unauthorized actions.
  • Implement additional security measures, such as web application firewalls and intrusion detection systems, to detect and prevent exploitation attempts.

Evidence notes

The vulnerability information is based on the CVE record and NVD details. The vendor and product information is not confirmed, with the canonical source listed as 'reference_domain_weak' and confidence level as 'low'. The Patchstack database provides additional information on the vulnerability, including mitigation and vendor references.

Official resources

This article is AI-assisted and based on the supplied source corpus.