VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Path Traversal via Customer Details

ID

WPSEC-2026-1309

Plugin

VikRentCar Car Rental Management System (vikrentcar)

Affected

from 1.2.0 before 1.4.9

Remediation

Update to 1.4.9 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-22

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21

Attack surface

VikRentCar Car Rental Management System on WPSec AttackSurface

Fix released

2026-10-19

Published

2026-10-21

Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Path Traversal via the front-end order documents upload in all versions from 1.2.0 up to, and including, 1.4.8, due to the customer documents folder name being built from the customer's first and last name, which were only lowercased and joined without removing path characters. This makes it possible for unauthenticated attackers who place a confirmed booking to create directories and write uploaded documents of the allowed file types outside of the intended customers directory, provided document upload is enabled.

References

• https://wpsec.com/vuln/WPSEC-2026-1309/
• https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/
• https://wordpress.org/plugins/vikrentcar/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS