# CVE-2026-61985: magepeopleteam Car Rental Manager missing authorization

Source: https://junglewise.ai/threats/cve-2026-61985-magepeopleteam-car-rental-manager-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-61985 · Severity: medium · CVSS 5.3 · Published 2026-07-13

The Car Rental Manager plugin for WordPress, which manages vehicle bookings and rental operations, contains a security flaw in its access control system. An unauthorized user can exploit incorrectly configured security levels to perform actions they should not be allowed to do. This could lead to unauthorized modifications of rental data or system settings, potentially disrupting business operations.

Vendors: [MagePeople Team](https://junglewise.ai/threats/vendors/magepeople-team).

## Quick answers

**Is CVE-2026-61985 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61985 being exploited in the wild.

**How severe is CVE-2026-61985?** Medium severity, with a CVSS score of 5.3, published 13 July 2026.

**Which products and versions are affected?** MagePeople Team Car Rental Manager <= 1.3.7.

**Is there a fix for CVE-2026-61985?** A patch was published on 1.3.8: Fixed in version 1.3.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61985 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61985?** Check whether you run MagePeople Team Car Rental Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Missing Authorization vulnerability (CWE-862) exists in the magepeopleteam Car Rental Manager plugin for WordPress through version 1.3.7. The flaw stems from incorrectly configured access control security levels within the plugin's components. A remote, unauthenticated attacker can exploit this weakness via the network to perform unauthorized actions. According to the CVSS metrics, the primary impact is on integrity, allowing for unauthorized data modification without affecting confidentiality or availability. The issue is addressed in version 1.3.8.

## Affected products

- magepeopleteam Car Rental Manager <= 1.3.7

## Timeline

- 2026-07-13: disclosed
- 2026-07-13: advisory
- 1.3.8: patched: Fixed in version 1.3.8

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/car-rental-manager/vulnerability/wordpress-car-rental-manager-plugin-1-3-7-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/car-rental-manager/vulnerability/wordpress-car-rental-manager-plugin-1-3-7-broken-access-control-vulnerability?_s_id=cve)