# Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Details via Thank You Page

- **ID:** WPSEC-2026-2001
- **Plugin:** Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment (`booking-and-rental-manager-for-woocommerce`), https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/
- **Affected versions:** all versions before 2.8.4
- **Fixed in:** 2.8.4 (Update to 2.8.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booking-and-rental-manager-for-woocommerce
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2001/

## Description

The Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress is vulnerable to Insecure Direct Object Reference via the offline-payment branch of the [rbfw_thankyou] Thank You page in all versions up to, and including, 2.8.3. This is due to the 'order_id' parameter being trusted after a token check that does not work: booking orders created by the plugin store no 'rbfw_token' value, and a 'token' parameter sent as an array is turned into an empty string, which then matches the empty stored token. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view any booking order by its sequential ID, including the customer's billing name, email address, booked item, dates and price details. When the checkout account requirement is disabled, unauthenticated attackers can do the same.

## References

- https://wpsec.com/vuln/WPSEC-2026-2001/
- https://plugins.svn.wordpress.org/booking-and-rental-manager-for-woocommerce/tags/2.8.4/
- https://wordpress.org/plugins/booking-and-rental-manager-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2001/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.