Authorization Bypass in RentMy Real-Time Rental Management Plugin for WordPress

CVE-2026-8690

What is CVE-2026-8690?

The RentMy Real-Time Rental Management Plugin for WordPress is susceptible to an authorization bypass vulnerability affecting all versions up to 4.0.4.1. This flaw arises from inadequate verification of user permissions, allowing unauthenticated attackers to execute unauthorized actions. Consequently, these attackers can read, create, modify, or delete event records contained in the rentmy_events option, as well as overwrite the rentmy_locationId option, which could lead to significant data breaches and manipulation of event data.

References