{
 "id": "WPSEC-2026-1309",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1309/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1309/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1309/index.md",
 "title": "VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Path Traversal via Customer Details",
 "description": "The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Path Traversal via the front-end order documents upload in all versions from 1.2.0 up to, and including, 1.4.8, due to the customer documents folder name being built from the customer's first and last name, which were only lowercased and joined without removing path characters. This makes it possible for unauthenticated attackers who place a confirmed booking to create directories and write uploaded documents of the allowed file types outside of the intended customers directory, provided document upload is enabled.",
 "plugin": {
  "slug": "vikrentcar",
  "name": "VikRentCar Car Rental Management System",
  "full_name": "VikRentCar Car Rental Management System",
  "wordpress_org": "https://wordpress.org/plugins/vikrentcar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/vikrentcar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/vikrentcar"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2.0",
    "from_inclusive": true,
    "to": "1.4.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2.0 before 1.4.9"
  ]
 },
 "introduced_in": "1.2.0",
 "fixed_in": "1.4.9",
 "remediation": "Update to 1.4.9 or later.",
 "fix_released": "2026-10-19T21:45:28+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:35:31.014516+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1309/",
  "https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/",
  "https://wordpress.org/plugins/vikrentcar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikrentcar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}