# VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Arbitrary File Deletion via Customer Document Deletion

- **ID:** WPSEC-2026-1308
- **Plugin:** VikRentCar Car Rental Management System (`vikrentcar`), https://wordpress.org/plugins/vikrentcar/
- **Affected versions:** from 1.2.0 before 1.4.9
- **Fixed in:** 1.4.9 (Update to 1.4.9 or later.)
- **Severity:** Medium 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vikrentcar
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1308/

## Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via the customer document deletion action (delete_customer_document) in all versions from 1.2.0 up to, and including, 1.4.8, due to missing nonce validation combined with insufficient path validation of the 'file' parameter, which was appended to the customer documents folder and only checked to be an existing file before being deleted. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, such as wp-config.php, which can lead to site takeover, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link and a customer with an existing documents folder is present.

## References

- https://wpsec.com/vuln/WPSEC-2026-1308/
- https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/
- https://wordpress.org/plugins/vikrentcar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1308/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.