CVE-2023-26002: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the 6Storage Rentals WordPress plugin, affecting versions through 2.19.5. The vulnerability allows exploiting incorrectly configured access control security levels (NVD, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization) with a CVSS v3.1 Base Score of 4.3 (Medium). The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating that the vulnerability requires network access, low attack complexity, and low privileges to exploit (NVD).

The vulnerability is categorized as a broken access control issue, which could potentially allow unprivileged users to execute certain higher privileged actions. The severity is considered low, with limited impact on integrity and no direct impact on confidentiality or availability (Patchstack).

The vulnerability requires subscriber-level privileges to exploit and is considered unlikely to be exploited due to its low severity impact (Patchstack).

As of June 2025, no official fix is available for this vulnerability. The issue affects versions up to 2.19.7, and due to its low severity impact, virtual patching has been deemed unnecessary (Patchstack).