Arbitrary File Upload Vulnerability in VikRentCar Plugin for WordPress
CVE-2025-5322
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 July 2025
What is CVE-2025-5322?
The VikRentCar Car Rental Management System plugin for WordPress has a serious vulnerability that allows authenticated users with Administrator-level access to upload arbitrary files due to inadequate file type validation in the do_updatecar and createcar functions. This flaw exposes the site's server to potential unauthorized file uploads, which can lead to remote code execution, compromising the security and integrity of the affected website.
Affected Version(s)
VikRentCar Car Rental Management System * <= 1.4.3