Unauthorized Data Access in Simple Bike Rental Plugin for WordPress

CVE-2025-14065

What is CVE-2025-14065?

The Simple Bike Rental plugin for WordPress is susceptible to unauthorized data exposure due to a lack of capability verification on the 'simpbire_carica_prenotazioni' AJAX action. This flaw affects all versions up to and including 1.0.6, allowing authenticated users with Subscriber-level access and higher to access sensitive booking data. This includes customers' personally identifiable information (PII), such as names, email addresses, and phone numbers, potentially leading to significant privacy risks.

References