CVE-2026-112836
HighCVSS 8.8Summary
Cross-Site Request Forgery (CSRF) vulnerability in the e4jvikwp VikRentCar plugin through version 1.4.8. The vulnerability allows unwanted actions to be performed on behalf of a logged-in user.
Risk Assessment
An attacker can trick a logged-in administrator into performing unwanted operations, potentially altering configuration or data.
Recommendation
Upgrade the VikRentCar plugin to a version later than 1.4.8 containing the fix.
Other vulnerabilities in VikRentCar
See all- CVE-2026-39790High
Reflected XSS vulnerability in the VikRentCar WordPress plugin, versions up to 1.4.7. Improper input neutralization during page generation allows reflected XSS attacks.
- CVE-2026-52699High
Versions of VikRentCar <= 1.4.5 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS