CVE-2026-8690: RentMy WordPress Plugin Authorization Bypass – Medium Severity

Technical summary

CVE-2026-8690 is an authorization bypass vulnerability (CWE-862) in the RentMy plugin affecting versions ≤4.0.4.1. The plugin stores rental event records in the WordPress option rentmy_events and a location identifier in rentmy_locationId, but does not validate user roles or capabilities before performing create, read, update, and delete operations on these options. This allows unauthenticated attackers to directly manipulate WordPress options through the plugin's interfaces without authentication checks, resulting in integrity compromise of rental data.

Business impact

Organizations relying on RentMy for rental management face unauthorized modification or loss of rental event data, which could disrupt booking operations, damage client trust, and create potential liability if malicious actors corrupt location information or delete legitimate reservations. While the CVSS score is moderate, the impact to operational data integrity is direct and immediate, with no confidentiality or availability component mitigating the risk in the score itself.

Affected systems

WordPress installations running the RentMy Real-Time Rental Management Plugin at version 4.0.4.1 or earlier are vulnerable. Any WordPress site using this plugin is at risk, regardless of theme or other plugins, since the vulnerability is intrinsic to the RentMy plugin's authorization logic.

Exploitability

Exploitation requires no special tools or authentication. An attacker can craft HTTP requests directly to WordPress REST endpoints or admin-ajax handlers exposed by the plugin to read, create, update, or delete event records. The attack vector is network-based with low complexity and requires no user interaction, making it trivial to automate.

Remediation

Update the RentMy Real-Time Rental Management Plugin to a version released after June 24, 2026, that includes proper authorization checks. Site administrators should verify the installed version and apply the patch immediately. Until patching is possible, consider temporarily disabling the plugin if rental management operations can be moved offline or paused.

Patch guidance

Check your WordPress plugin updates or the RentMy plugin repository for versions released after the publication date (June 24, 2026). WordPress administrators can navigate to Plugins > Installed Plugins, locate RentMy, and apply the available update. Verify that the updated version includes proper user capability verification before allowing event and location option modifications. If no patch is available from the vendor, contact RentMy support or consider alternative rental management plugins with stronger security postures.

Detection guidance

Monitor WordPress audit logs for unauthorized changes to rentmy_events or rentmy_locationId options, particularly those originating from unauthenticated or low-privileged users. Web Application Firewalls (WAFs) can detect unusual patterns of option updates from external IPs. Check for suspicious POST requests to wp-admin/admin-ajax.php with action parameters tied to rental event handling. Review WordPress user logs for create, update, or delete operations on rental events by non-admin users or from unexpected IP addresses.

Why prioritize this

Although the CVSS base score is 5.3 (Medium), the vulnerability enables direct manipulation of operational rental data without authentication, creating immediate business disruption risk. The ease of exploitation and lack of authentication requirements elevate practical risk for any organization actively using this plugin. Prioritize patching if rental management is business-critical; deprioritize only if the plugin is disabled or the site is air-gapped.

Risk score, explained

The CVSS:3.1 score of 5.3 reflects low complexity network-based access, no authentication barrier, and integrity impact (modification of event and location data). The score does not include confidentiality loss (reading events is possible but unscored) or availability loss, resulting in a Medium severity rating. In context, the lack of authentication requirements and the operational sensitivity of rental data justify close attention despite the moderate numeric score.

Frequently asked questions