{
 "id": "WPSEC-2026-1854",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1854/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1854/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1854/index.md",
 "title": "VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via Cars List Block Attributes",
 "description": "The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to SQL Injection via the 'catid', 'order' and 'numb' attributes of the Cars List widget block in versions 1.4.0 up to, and including, 1.4.10. This is due to the values being concatenated directly into SQL queries in Modvikrentcar_carsHelper::getCars() without escaping, whitelisting or type casting. Since 1.4.0 the widget is also registered as a Gutenberg block, so these values can come from block attributes that any post author sets. This makes it possible for authenticated attackers with contributor-level access and above to append additional SQL to existing queries and extract sensitive information from the database.",
 "plugin": {
  "slug": "vikrentcar",
  "name": "VikRentCar Car Rental Management System",
  "full_name": "VikRentCar Car Rental Management System",
  "wordpress_org": "https://wordpress.org/plugins/vikrentcar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/vikrentcar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/vikrentcar"
 },
 "type": "SQLI",
 "cwe": [
  "CWE-89"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.4.0",
    "from_inclusive": true,
    "to": "1.4.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.4.0 before 1.4.11"
  ]
 },
 "introduced_in": "1.4.0",
 "fixed_in": "1.4.11",
 "remediation": "Update to 1.4.11 or later.",
 "fix_released": "2026-10-27T15:04:08+00:00",
 "published": "2026-10-28T15:45:14+00:00",
 "updated": "2026-10-28T09:20:14.999844+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1854/",
  "https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.11/",
  "https://wordpress.org/plugins/vikrentcar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/vikrentcar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-28"
 }
}