{
 "id": "WPSEC-2026-2001",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2001/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2001/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2001/index.md",
 "title": "Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Details via Thank You Page",
 "description": "The Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress is vulnerable to Insecure Direct Object Reference via the offline-payment branch of the [rbfw_thankyou] Thank You page in all versions up to, and including, 2.8.3. This is due to the 'order_id' parameter being trusted after a token check that does not work: booking orders created by the plugin store no 'rbfw_token' value, and a 'token' parameter sent as an array is turned into an empty string, which then matches the empty stored token. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view any booking order by its sequential ID, including the customer's billing name, email address, booked item, dates and price details. When the checkout account requirement is disabled, unauthenticated attackers can do the same.",
 "plugin": {
  "slug": "booking-and-rental-manager-for-woocommerce",
  "name": "Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment",
  "full_name": "Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment",
  "wordpress_org": "https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booking-and-rental-manager-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booking-and-rental-manager-for-woocommerce"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.4",
 "remediation": "Update to 2.8.4 or later.",
 "fix_released": "2026-10-29T07:28:32+00:00",
 "published": "2026-10-30T07:45:53+00:00",
 "updated": "2026-10-29T17:44:16.361844+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2001/",
  "https://plugins.svn.wordpress.org/booking-and-rental-manager-for-woocommerce/tags/2.8.4/",
  "https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booking-and-rental-manager-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}