Cross-Site Request Forgery Vulnerability in VikRentCar by e4jvikwp
CVE-2026-112836

8.8HIGH

Key Information:

Vendor

WordPress
Status
Vikrentcar
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112836?

The VikRentCar plugin by e4jvikwp is exposed to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows attackers to perform unauthorized actions on behalf of users without their consent. The issue affects versions of VikRentCar up to 1.4.8, making it critical for users to apply patches promptly to secure their installations against potential exploits. Mitigation strategies include implementing CSRF tokens in forms and sessions to ensure authentic requests.

Affected Version(s)

VikRentCar 0 <= 1.4.8

References

https://patchstack.com/database/wordpress/plugin/vikrentc...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ayukiab | Patchstack Bug Bounty Program
.