Junglewise Threat Intelligence

CVE-2026-8690: RentMy Real-Time Rental Management Plugin authorization bypass

CVE-2026-8690 · Severity: medium · CVSS 5.3 · Published 2026-06-24

Executive brief

The RentMy plugin for WordPress, which manages real-time rental bookings and inventory, contains a security flaw that allows unauthorized users to modify rental data. An attacker could remotely create, change, or delete event records and alter location settings without needing a password. This could lead to disrupted business operations, incorrect booking information, and unauthorized changes to how the rental service is configured.

Technical details

The RentMy Real-Time Rental Management Plugin for WordPress (up to version 4.0.4.1) suffers from a missing authorization vulnerability (CWE-862) within its AJAX handlers. The plugin fails to perform adequate permission checks when processing requests to modify plugin settings and event data. Consequently, an unauthenticated remote attacker can send crafted requests to the WordPress AJAX endpoint to read, create, update, or delete records in the 'rentmy_events' option. Additionally, attackers can overwrite the 'rentmy_locationId' configuration, potentially redirecting or misconfiguring rental location logic. The vulnerability is rooted in the 'class-rentmy-ajax.php' component.

Affected products

  • RentMy RentMy Real-Time Rental Management Plugin up to, and including, 4.0.4.1

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References