# VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via Cars List Block Attributes

- **ID:** WPSEC-2026-1854
- **Plugin:** VikRentCar Car Rental Management System (`vikrentcar`), https://wordpress.org/plugins/vikrentcar/
- **Affected versions:** from 1.4.0 before 1.4.11
- **Fixed in:** 1.4.11 (Update to 1.4.11 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vikrentcar
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1854/

## Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to SQL Injection via the 'catid', 'order' and 'numb' attributes of the Cars List widget block in versions 1.4.0 up to, and including, 1.4.10. This is due to the values being concatenated directly into SQL queries in Modvikrentcar_carsHelper::getCars() without escaping, whitelisting or type casting. Since 1.4.0 the widget is also registered as a Gutenberg block, so these values can come from block attributes that any post author sets. This makes it possible for authenticated attackers with contributor-level access and above to append additional SQL to existing queries and extract sensitive information from the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-1854/
- https://plugins.svn.wordpress.org/vikrentcar/tags/1.4.11/
- https://wordpress.org/plugins/vikrentcar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1854/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.