This vulnerability in magepeopleteam Booking and Rental Manager (up to version 2.6.9) arises from missing authorization controls, allowing attackers to bypass access restrictions. The issue is due to incorrectly configured access control security levels, which could permit unauthorized users to perform actions that compromise system integrity and availability. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with no confidentiality impact but with integrity and availability impacts rated as low and high respectively. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

Exploitation of this vulnerability could allow unauthorized users to perform actions that affect the integrity and availability of the Booking and Rental Manager system. There is no impact on confidentiality. The medium severity rating reflects the potential for disruption or manipulation of booking and rental operations without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected plugin functionalities and reviewing access control configurations to limit exposure.