IT SBIT Services
Schneeberger
DEEN
CVE tracker

VikRentCar Car Rental Management System: CSRF to remote code execution

CVE-2026-111120High 8.8

← All vulnerabilities

Summary

The VikRentCar Car Rental Management System plugin for WordPress, versions up to and including 1.4.8, does not properly validate nonces in the condtext_update_tmpl AJAX function. An unauthenticated attacker can send a forged request that makes a logged-in administrator's browser write PHP code into plugin template files, which the plugin then includes and executes on the server. Exploitation requires that an administrator is tricked into an action such as clicking a link while logged in.

Affected

  • VikRentCar Car Rental Management System plugin for WordPress, all versions up to and including 1.4.8

Fixed in

Unknown. The fixed version is not confirmed by the vendor or Wordfence in the available sources. The 1.4.9 changelog mentions added CSRF token validation, which suggests 1.4.9 is the first unaffected release, but this is not verified.

Workaround

Unknown. No vendor workaround or virtual patch has been identified for this CVE.

  • Until the plugin is updated, administrators should avoid clicking unknown links while logged into WordPress and log out of the admin area when browsing elsewhere.
  • Check template files under site/helpers/ (for example email_tmpl.php) for unexpected PHP code and compare them with a clean copy of the plugin. This is detection, not a fix.

Exploitation

  • No known exploitation in the wild at the time of research.
  • No public proof-of-concept or exploit was found; VulDB states that no exploit is available.
  • Not listed in CISA KEV according to a third-party tracker; the CISA catalogue was not checked directly.
  • EPSS: 0.32 % (percentile 24).

Our recommendation

  • Update VikRentCar to the latest available version, at least 1.4.9, and confirm the fixed version against the Wordfence advisory.
  • Until updated, restrict admin logins to trusted browsers and avoid browsing the web while logged into the WordPress admin area.
  • Check the plugin template files for unexpected PHP code and review admin accounts and recent file changes if the site was exposed while vulnerable.
  • Patch the whole plugin, as other open issues affect the same product.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:38.

Original description (NVD)

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

NVD references (8)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed