Blind SQL Injection Vulnerability in VikRentCar Car Rental Management System by WordPress

CVE-2026-116750

What is CVE-2026-116750?

The VikRentCar Car Rental Management System plugin for WordPress is exposed to a blind SQL injection vulnerability through the 'catid' parameter. This flaw exists in all versions up to and including 1.4.10, primarily due to inadequate escaping of the user-supplied input and insufficient preparation of the SQL query. Authenticated users with contributor-level access or higher can exploit this weakness by injecting additional SQL commands into existing queries. Such actions allow an attacker to extract sensitive information from the database. Notably, contributors can leverage the REST API to store a malicious block in a pending post, which can then be executed by previewing that post, effectively circumventing security measures that would typically protect against such vulnerabilities.

References