Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment has 20 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 20 are fixed as of October 2026. Their average CVSS score is 6.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 10 disclosures.
The most common weakness is Missing Authorization, behind 10 of the records (50%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data.
Every one of the 20 issues recorded for Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment has a vendor fix available, so running the current release closes all known holes.
16 independent researchers contributed these findings, most of them (4) reported by LVT-tholv2k. Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.
CVE-2025-27011Booking and Rental Manager <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion
Read the full analysisVulnerability Records

Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
Author
magepeopleteam
Booking and Rental Manager for WooCommerce helps you build a rental booking system inside WordPress and WooCommerce. Create single-day, multi-day, appointment, resort, equipment, dress, and multi-item rentals, then accept bookings through the WooCommerce checkout flow. Use it for car rentals, bike rentals, equipment rentals, dress rentals, appointment booking, resort booking, vacation rentals, parking, boat rentals, sports kits, office spaces, and other rental businesses that need date-based booking, pricing, inventory, and order management. Demo and documentation Frontend live demo Documentation Pro version What you can build Car and bike rental websites Equipment and tool rental websites Dress and costume rental websites Appointment booking systems Resort and room booking websites Vacation rental and holiday rental websites Boat, sports kit, parking, and office space rental websites Multi-item rental catalogs with separate item quantities Key free features WooCommerce-based rental checkout and payment flow Single-day and multi-day rental booking Multi-item rental support Appointment and resort booking support Hourly, daily, weekly, monthly, day-wise, day-long, and day-night pricing options Pickup and drop-off location settings Inventory and availability controls Extra services and add-ons Dress size configuration Related rental items and highlighted features Rental galleries, sliders, and multiple list layouts Frontend customer booking dashboard Order list with booking details Tax settings and WooCommerce payment gateway support SecureHold WP integration: hold fixed security deposits on the customer’s card as a separate Stripe authorization instead of charging them Responsive layouts and multilingual translation support Shortcodes for rental lists and single-item booking forms Pro features Delivery & collection charges Registration forms Drag-and-drop form builder Request booking (quote and approval) Item reviews Customer portal Edit a booking after purchase Choose visible columns Security deposit ledger Edit stock from the inventory screen Booking calendar Google Calendar sync A4 PDF receipt Thermal / POS receipt Customisable PDF templates WooCommerce booking email Quote request emails Google review request email Reports page Bookings export View Pro version Video overview Shortcodes Show rental items: [rent-list type='' style='grid' show='' columns='' left-filter='yes/no' category='' order='DESC'] Show only single-day bike/car rentals: [rent-list type='bike_car_sd'] Show grid-style rental list: [rent-list style='grid' left-filter='yes/no'] Show list-style rental list: [rent-list style='list' left-filter='yes/no'] Show six rental items: [rent-list show='6'] Show rental items in ascending order: [rent-list order='ASC'] Show a four-column rental list: [rent-list columns='4'] Show rentals from selected category IDs: [rent-list category='2,3'] Show the booking form for one rental item: [rent-add-to-cart id='1'] Support Need help or want to suggest an improvement? Use the support form. Theme compatibility The plugin is designed to work with standards-compliant WordPress themes. Compatible third-party integrations SecureHold WP 3.4.11+ can hold a fixed WpRently security deposit as a separate Stripe authorization instead of adding it to the WooCommerce total, once WooCommerce checkout, the Stripe Gateway and SecureHold’s MagePeople compatibility option are all set up; see SecureHold docs for setup help. In each Rent Item’s Security Deposit settings, “Multiply fixed deposit by booked quantity” charges the fixed amount for every booked unit, including each room or multiple-item unit. It is off for existing items; percentage deposits continue to use the rental subtotal. SecureHold’s static hold does not support this option and requires a compatible SecureHold update to fall back to WpRently checkout. Addons for this plugin Booking and Rental Manager Pro Addon: Seasonal Pricing — Apply different rental prices based on seasons, dates, or time ranges. Addon: Backend Order — Create and manage rental orders directly from the admin dashboard. Addon: Min and Max Booking Day — Set minimum and maximum booking limits for rental items. Addon: Discount Over X Days — Set discounts based on the number of rental days. Addon: Multi Day Price Saver — Offer special discounts for multi-day rentals to encourage longer bookings. Other plugins Bus Booking Manager Bus Ticket Booking with Seat Reservation WooCommerce Events Manager Privacy Policy This Plugin uses Appneck SDK to collect some telemetry data upon the user’s confirmation to troubleshoot problems faster & make product improvements. Appneck SDK does not gather any data by default. The SDK only starts gathering basic telemetry data *when a user allows it via the admin notice. We collect the data to ensure a great user experience for all our users. Integrating Appneck SDK **DOES NOT IMMEDIATELY* start gathering data, *without confirmation from users in any case.* Learn more about how Appsero collects and uses data.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C