This vulnerability in magepeopleteam Booking and Rental Manager (<= 2.6.0) arises from missing authorization checks, allowing users with limited privileges to bypass intended access controls. The issue is related to incorrectly configured access control security levels within the plugin, which could lead to unauthorized access to booking-related information. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality but not integrity or availability.

Successful exploitation could allow an attacker with some level of privileges to access sensitive booking information without proper authorization. The impact is limited to confidentiality as integrity and availability are not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict user privileges to minimize exposure. Monitor for updates from magepeopleteam regarding patches or mitigations.