Cross-Site Request Forgery Vulnerability in VikRentCar Plugin for WordPress

CVE-2026-111120

What is CVE-2026-111120?

The VikRentCar Car Rental Management System plugin for WordPress is susceptible to Cross-Site Request Forgery due to lax nonce validation. This flaw allows unauthenticated attackers to potentially execute arbitrary PHP code within the plugin's files. The vulnerability arises in the context_update_tmpl function, which fails to properly validate nonces. Consequently, an attacker can exploit this weakness by persuading an administrator to follow a crafted link, resulting in unauthorized PHP payloads being injected into executables such as email_tmpl.php. This injected code circumvents standard sanitization procedures, posing significant risks if successfully executed.

References