CVE-2025-14065 affects the Simple Bike Rental WordPress plugin by lacking proper capability checks on the AJAX action 'simpbire_carica_prenotazioni'. This missing authorization allows authenticated users with low privileges (Subscriber and above) to retrieve sensitive booking data containing PII. The vulnerability impacts all versions up to and including 1.0.6. The CVSS score of 4.3 indicates a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. There is no indication of an official patch or vendor advisory specifying remediation status.

An attacker with authenticated Subscriber-level access can access all booking records, exposing customers' personally identifiable information such as names, email addresses, and phone numbers. This exposure could lead to privacy violations and potential misuse of customer data. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only, and consider disabling or restricting access to the vulnerable AJAX action if possible. Monitor for updates from the plugin vendor or WordPress security channels for an official fix.