# CVE-2026-78258: WordPress Booking and Rental Manager broken access control

Source: https://junglewise.ai/threats/cve-2026-78258-wordpress-booking-and-rental-manager-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78258 · Severity: medium · CVSS 5.3 · Published 2026-08-24

Booking and Rental Manager is a popular WordPress plugin for managing rental reservations and bookings on e-commerce sites. An unauthenticated attacker can bypass access controls to view or modify data they should not have permission to access, potentially exposing customer booking information and reservation details.

Technologies: [MagePeople Booking and Rental Manager](https://junglewise.ai/threats/technologies/booking-and-rental-manager). Vendors: [MagePeople](https://junglewise.ai/threats/vendors/magepeople).

## Quick answers

**Is CVE-2026-78258 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78258 being exploited in the wild.

**How severe is CVE-2026-78258?** Medium severity, with a CVSS score of 5.3, published 24 August 2026.

**Which products and versions are affected?** MagePeople Booking and Rental Manager <= 2.7.5.

**Is there a fix for CVE-2026-78258?** A patch was published on 2026-08-24: Version 2.7.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78258 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78258?** Check whether you run MagePeople Booking and Rental Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Booking and Rental Manager WordPress plugin through version 2.7.5 contains a broken access control vulnerability classified as OWASP A01:2021. The vulnerability allows unauthenticated attackers to access restricted pages or perform unauthorized actions without proper permission validation. Attack vectors are network-accessible and require no authentication or user interaction. The vulnerability was patched in version 2.7.6; affected installations should update immediately to mitigate unauthorized data access to customer bookings and rental information.

## Affected products

- Magepeople Booking and Rental Manager <= 2.7.5

## Timeline

- 2026-01-21: disclosed: Reported by Bao - BlueRock
- 2026-08-24: advisory: Published by Patchstack
- 2026-08-24: patched: Version 2.7.6 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-7-5-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-7-5-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Booking and Rental Manager broken access control in subscriber role](https://junglewise.ai/threats/cve-2026-54850-subscriber-broken-access-control-in-booking-and-rental-manager-2)
- [Booking and Rental Manager broken access control in subscriber operations](https://junglewise.ai/threats/cve-2026-81762-booking-and-rental-manager-broken-access-control-in-subscriber)
- [Booking and Rental Manager PHP object injection](https://junglewise.ai/threats/cve-2026-78257-booking-and-rental-manager-php-object-injection)