CVE-2025-39457: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the WordPress Booking and Rental Manager plugin affecting versions up to 2.2.8. The vulnerability was identified on April 17, 2025, and allows exploiting incorrectly configured access control security levels (Patchstack Database).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 5.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that it can be exploited over the network with low attack complexity, requires no privileges or user interaction, and has a limited impact on integrity (NVD Database).

The vulnerability allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. While the specific impact varies case by case, the CVSS score indicates a low severity impact that primarily affects the system's integrity (Patchstack Database).

The vulnerability has been fixed in version 2.2.9 of the Booking and Rental Manager plugin. Users are advised to update to version 2.2.9 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack Database).