CVE-2026-8690 is an authorization bypass vulnerability (CWE-862) affecting the RentMy Real-Time Rental Management Plugin for WordPress. The plugin fails to properly verify whether a user is authorized to perform certain actions, enabling unauthenticated attackers to manipulate event records and location ID options within the WordPress database. This impacts all plugin versions up to and including 4.0.4.1. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

An attacker without authentication can read, create, update, and delete event records stored in the rentmy_events WordPress option and overwrite the rentmy_locationId option. This could lead to unauthorized modification of rental event data and location settings, potentially disrupting rental management operations or causing data integrity issues. There is no indication of confidentiality or availability impact beyond integrity loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and WordPress administrative interfaces, and monitor for unusual activity related to rental event data. Avoid exposing the affected plugin to untrusted users. Follow vendor updates closely for any forthcoming patches or official mitigations.