This vulnerability in magepeopleteam Booking and Rental Manager (<= 2.6.0) arises from missing authorization checks, leading to incorrect access control configurations. It allows users with limited privileges to exploit the system by bypassing intended access restrictions. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and requires privileges but no user interaction. The impact is high confidentiality loss but no integrity or availability impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

The vulnerability allows unauthorized access to sensitive data due to missing authorization controls, potentially exposing confidential information. There is no impact on data integrity or availability. The medium severity reflects the moderate risk posed by this exposure, especially in environments where sensitive booking or rental data is handled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for unusual activity. Avoid granting unnecessary privileges to users interacting with the Booking and Rental Manager plugin. Apply official patches promptly once released by magepeopleteam.