VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Arbitrary File Deletion via Customer Document Deletion
- ID
- WPSEC-2026-1308
- Plugin
- VikRentCar Car Rental Management System (vikrentcar)
- Affected
- from 1.2.0 before 1.4.9
- Remediation
- Update to 1.4.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- VikRentCar Car Rental Management System on WPSec AttackSurface
- Fix released
- Published
Description
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via the customer document deletion action (delete_customer_document) in all versions from 1.2.0 up to, and including, 1.4.8, due to missing nonce validation combined with insufficient path validation of the 'file' parameter, which was appended to the customer documents folder and only checked to be an existing file before being deleted. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, such as wp-config.php, which can lead to site takeover, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link and a customer with an existing documents folder is present.
References
- https://wpsec.com/vuln/WPSEC-2026-1308/
- https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/
- https://wordpress.org/plugins/vikrentcar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS