{
 "id": "WPSEC-2026-1308",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1308/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1308/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1308/index.md",
 "title": "VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Arbitrary File Deletion via Customer Document Deletion",
 "description": "The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via the customer document deletion action (delete_customer_document) in all versions from 1.2.0 up to, and including, 1.4.8, due to missing nonce validation combined with insufficient path validation of the 'file' parameter, which was appended to the customer documents folder and only checked to be an existing file before being deleted. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, such as wp-config.php, which can lead to site takeover, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link and a customer with an existing documents folder is present.",
 "plugin": {
  "slug": "vikrentcar",
  "name": "VikRentCar Car Rental Management System",
  "full_name": "VikRentCar Car Rental Management System",
  "wordpress_org": "https://wordpress.org/plugins/vikrentcar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/vikrentcar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/vikrentcar"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2.0",
    "from_inclusive": true,
    "to": "1.4.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2.0 before 1.4.9"
  ]
 },
 "introduced_in": "1.2.0",
 "fixed_in": "1.4.9",
 "remediation": "Update to 1.4.9 or later.",
 "fix_released": "2026-10-19T21:45:28+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:35:31.014516+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1308/",
  "https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/",
  "https://wordpress.org/plugins/vikrentcar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikrentcar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}