CVE-2026-27432: CWE-639 Authorization Bypass Through User-Controlled Key in sc Internet Vivoo WP Rentals

This vulnerability, identified as CWE-639 (Authorization Bypass Through User-Controlled Key), affects WP Rentals by sc Internet Vivoo. It allows bypassing authorization controls due to improperly configured access control security levels influenced by user-controlled keys. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No known exploits in the wild or vendor patches have been reported.

The vulnerability could allow an attacker with low privileges to bypass authorization controls, potentially leading to unauthorized modification of data or limited disruption of availability. There is no impact on confidentiality. The overall impact is moderate given the integrity and availability impacts are low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Users should monitor vendor communications for updates and consider restricting access privileges as a precaution.