Car Rental Manager Vulnerabilities

The Car Rental Manager plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.3.9 via deserialization of untrusted input. This makes it possible for authenticated attackers, with editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerabl...

CVSS:

6.6

Affected:

up to 1.3.9

Fixed in:

1.4.0

Disclosed:

Aug 12, 2026

CVE-2026-27380 on NVD →

The Car Rental Manager – Online Vehicle Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.3.7

Fixed in:

1.3.8

Disclosed:

Aug 7, 2026

CVE-2026-61985 on NVD →

The Car Rental Manager for WordPress – Online Vehicle Booking System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perfo...

CVSS:

4.3

Affected:

up to 1.0.9

Fixed in:

1.2.0

Disclosed:

Dec 24, 2025

CVE-2025-69327 on NVD →