Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Details via Thank You Page
- ID
- WPSEC-2026-2001
- Plugin
- Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment (booking-and-rental-manager-for-woocommerce)
- Affected
- all versions before 2.8.4
- Remediation
- Update to 2.8.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-30
- Attack surface
- Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment on WPSec AttackSurface
- Fix released
- Published
Description
The Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress is vulnerable to Insecure Direct Object Reference via the offline-payment branch of the [rbfw_thankyou] Thank You page in all versions up to, and including, 2.8.3. This is due to the 'order_id' parameter being trusted after a token check that does not work: booking orders created by the plugin store no 'rbfw_token' value, and a 'token' parameter sent as an array is turned into an empty string, which then matches the empty stored token. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view any booking order by its sequential ID, including the customer's billing name, email address, booked item, dates and price details. When the checkout account requirement is disabled, unauthenticated attackers can do the same.
References
- https://wpsec.com/vuln/WPSEC-2026-2001/
- https://plugins.svn.wordpress.org/booking-and-rental-manager-for-woocommerce/tags/2.8.4/
- https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS