CVE-2026-111120 in VikRentCar Car Rental Management System Plugin
Summary
by MITRE • 10/28/2026
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The VikRentCar Car Rental Management System plugin for WordPress contains a critical Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.4.8. This flaw stems from insufficient validation of nonces within the condtext_update_tmpl function, which is responsible for updating template contexts. The absence or incorrect implementation of nonce verification allows unauthenticated attackers to craft forged requests that appear legitimate when executed by an authenticated administrator. Because WordPress relies on these nonces to distinguish between genuine user actions and malicious automated requests, their omission effectively removes a primary defense mechanism against CSRF attacks, enabling external actors to manipulate state-changing operations without proper authorization checks.
The operational impact of this vulnerability is severe, as it facilitates Remote Code Execution (RCE) on the targeted server. An attacker can exploit the lack of validation to write arbitrary PHP code directly into executable template files managed by the plugin, such as site/helpers/email_tmpl.php or similar configuration files. These files are subsequently included and executed by functions like loadEmailTemplate() and loadPdfTemplate(). When these templates are loaded during normal system operations, the injected malicious payload is interpreted and run by the server's PHP engine. This process grants the attacker full control over the web application environment, potentially leading to complete compromise of the underlying infrastructure, data exfiltration, or further lateral movement within the network.
A critical aspect of this vulnerability lies in how the plugin handles input sanitization, which inadvertently aids exploitation rather than preventing it. The developer implemented a logic involving _PHP_OPEN_/_PHP_CLOSE_ placeholder expansion and a cleanPHPSourceCode() function intended to sanitize user input. However, these mechanisms explicitly reverse the effects of standard WordPress sanitization functions like sanitize_text_field and saveHTML(). By decoding HTML entities and restoring literal PHP tags that were previously escaped or sanitized, the plugin effectively neutralizes its own security controls. This design flaw ensures that any malicious code injected through a forged request bypasses filtering layers and is written to disk in an executable format, ready for immediate execution upon template loading.
From a classification perspective, this vulnerability aligns with CWE-352: Cross-Site Request Forgery (CSRF), due to the failure to verify user intent via nonces or similar tokens. Furthermore, it maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), as arbitrary code is injected into a file that is subsequently executed by the application. In terms of adversary tactics, this exploitation path corresponds to ATT&CK technique T1059: Command and Scripting Interpreter, specifically through PHP execution, allowing attackers to establish persistence or escalate privileges after initial access via social engineering or link manipulation.
Successful exploitation requires an additional step beyond technical vulnerability alone; the attacker must trick a site administrator into performing an action, such as clicking on a maliciously crafted link or submitting a forged form while logged in. This dependency means that while the technical flaw is severe, its practical application relies heavily on social engineering tactics to gain administrative interaction. To mitigate this risk, administrators should immediately update VikRentCar to version 1.4.9 or later where these issues are addressed. If updating is not immediately possible, implementing strict CSRF protection at the web server level using anti-CSRF tokens and restricting file write permissions for template directories can reduce exposure. Additionally, reviewing custom code that inverts sanitization logic should be prioritized during security audits to prevent similar bypasses in other plugins or themes.