VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via Cars List Block Attributes
- ID
- WPSEC-2026-1854
- Plugin
- VikRentCar Car Rental Management System (vikrentcar)
- Affected
- from 1.4.0 before 1.4.11
- Remediation
- Update to 1.4.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-28
- Attack surface
- VikRentCar Car Rental Management System on WPSec AttackSurface
- Fix released
- Published
Description
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to SQL Injection via the 'catid', 'order' and 'numb' attributes of the Cars List widget block in versions 1.4.0 up to, and including, 1.4.10. This is due to the values being concatenated directly into SQL queries in Modvikrentcar_carsHelper::getCars() without escaping, whitelisting or type casting. Since 1.4.0 the widget is also registered as a Gutenberg block, so these values can come from block attributes that any post author sets. This makes it possible for authenticated attackers with contributor-level access and above to append additional SQL to existing queries and extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-1854/
- https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.11/
- https://wordpress.org/plugins/vikrentcar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS