VikRentCar WordPress plugin: Cross-Site Request Forgery (CSRF)

Summary

The VikRentCar WordPress plugin up to and including version 1.4.8 contains a Cross-Site Request Forgery (CSRF) flaw. An attacker can trick a logged-in user, such as a site administrator, into visiting a malicious page that performs actions on the site without their knowledge. Exploitation requires that such a user interacts with the attacker's content, and no privileges are needed beforehand.

Affected

• VikRentCar WordPress plugin, all versions up to and including 1.4.8

Fixed in

• Version 1.4.9 or later (per Patchstack advisory and vendor changelog)

Workaround

Unknown. No vendor or Patchstack workaround is documented.

Exploitation

• Not known to be exploited in the wild.
• Not listed in the CISA KEV catalog.
• EPSS probability below 1%.
• No public proof-of-concept found.

Our recommendation

• Identify all WordPress sites running VikRentCar and check the installed version.
• Update to version 1.4.9 or later and check for newer releases, as a separate XSS CVE affects 1.4.9 and earlier.
• Until patched, restrict wp-admin access (for example by IP allowlisting) and log out of admin sessions when not in use.
• Review admin accounts and logs for unexpected configuration or template changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for VikRentCar CSRF (CVE-2026-112836) patchstack.com
• OpenCVE entry for CVE-2026-112836 app.opencve.io
• VikRentCar on WordPress.org (changelog) wordpress.org
• VulDB entry 429500 (related XSS, affects 1.4.9 and earlier) vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:35.