WordPress RentMy Plugin Unauthenticated Settings Update Vulnerability (CVE-2026-6690)

Vulnerability Overview Vulnerability Name: RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action CVE ID: CVE-2026-6690 CVSS Score: 5.3 (Medium) Publication Date: June 23, 2026 Last Updated: June 24, 2026 Researcher: Legion Hunter Impact Scope Affected Software: RentMy Real-Time Rental Management Plugin Affected Versions: <= 4.0.4.1 Vulnerability Type: Missing authorization allowing unauthenticated attackers to read, create, update, and delete event records stored in the WordPress option, as well as overwrite the option. Remediation Patch Status: No known patch available Recommended Actions: Review the vulnerability details and implement mitigation measures based on your organization's risk tolerance. Uninstalling the affected software and seeking alternatives may be necessary. Additional Information Software Type: Plugin Software Identifier: rentmy-online-rental-shop (view on wordpress.org) API Access: Wordfence Intelligence provides free personal and commercial API access to the WordPress vulnerability database. Notification Service: Install Wordfence to receive immediate notifications when your site is impacted by new vulnerabilities. Documentation: The Wordfence Intelligence WordPress Vulnerability Database is fully accessible and queryable via API at no cost. Copyright Information Copyright: 2012-2026 Defiant Inc. MITRE Corporation: 1999-2026 Contact Information Contact Email: support@wordfence.com Business Hours Hours: 9am-6pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 1 hour, 365 days a year Additional Links Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: [Link] Twitter: [Link] LinkedIn: [Link] Instagram: [Link] Products and Support Wordfence Free: [Link] Wordfence Premium: [Link] Wordfence Care: [Link] Wordfence Response: [Link] Wordfence CLI: [Link] Wordfence Intelligence: [Link] Wordfence Central: [Link] Support Documentation: [Link] Learning Center: [Link] Free Support: [Link] Premium Support: [Link] News Blog: [Link] In The News: [Link] Vulnerability Advisories: [Link] About About Wordfence: [Link] Affiliate Program: [Link] Employment: [Link] Contact: [Link] Security: [Link] CVE Request Form: [Link] Subscription Subscribe to News and Updates: [Link] Disclaimer Disclaimer: [Link] Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence: [Link] Summary This vulnerability involves unauthorized settings updates in the RentMy Real-Time Rental Management Plugin, affecting versions <= 4.0.4.1. There are currently no known patches; it is recommended to take appropriate measures based on organizational risk tolerance. Wordfence Intelligence offers free API access and notification services to help users stay informed and address vulnerabilities promptly.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress RentMy Plugin Unauthenticated Settings Update Vulnerability (CVE-2026-6690)

More from this source