Vulnerabilities / Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment / WPSEC-2026-2000
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.3 - Unauthenticated Sensitive Information Exposure via Public Order Post Type
Medium 5.3
CWE-200Fixed in 2.8.4
- ID
- WPSEC-2026-2000
- Plugin
- Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment (booking-and-rental-manager-for-woocommerce)
- Affected
- all versions before 2.8.4
- Remediation
- Update to 2.8.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-30
- Attack surface
- Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment on WPSec AttackSurface
- Fix released
- Published
Description
The Booking and Rental Manager for Bike plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.3 due to the booking order post type being registered as public and not excluded from search. This makes it possible for unauthenticated attackers to discover booking order records, whose titles contain customer names, through site search and other public listings.
References
- https://wpsec.com/vuln/WPSEC-2026-2000/
- https://plugins.svn.wordpress.org/booking-and-rental-manager-for-woocommerce/tags/2.8.4/
- https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS