# VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Path Traversal via Customer Details

- **ID:** WPSEC-2026-1309
- **Plugin:** VikRentCar Car Rental Management System (`vikrentcar`), https://wordpress.org/plugins/vikrentcar/
- **Affected versions:** from 1.2.0 before 1.4.9
- **Fixed in:** 1.4.9 (Update to 1.4.9 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vikrentcar
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1309/

## Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Path Traversal via the front-end order documents upload in all versions from 1.2.0 up to, and including, 1.4.8, due to the customer documents folder name being built from the customer's first and last name, which were only lowercased and joined without removing path characters. This makes it possible for unauthenticated attackers who place a confirmed booking to create directories and write uploaded documents of the allowed file types outside of the intended customers directory, provided document upload is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1309/
- https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.9/
- https://wordpress.org/plugins/vikrentcar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1309/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.