CVE-2026-115840 in VikRentCar Car Rental Management System Plugin
Summary
by MITRE • 10/31/2026
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The handler requires only a WordPress nonce (vikwp_nonce), which the plugin itself emits to unauthenticated visitors on the public booking-confirmation page, allowing an attacker to obtain a valid token without any account.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The VikRentCar Car Rental Management System is a widely used WordPress plugin designed to facilitate car rental operations by providing features such as vehicle management, reservation handling, and payment processing integration. While these functionalities are essential for business owners managing online rentals, the complexity of interacting with user inputs often introduces security risks if not properly secured. In versions up to 1.4.9, a critical vulnerability exists within the plugin that allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks. This flaw stems from insufficient input sanitization and output escaping mechanisms when handling specific parameters passed through the application interface. The primary vector for this exploitation is the poplink parameter, which is intended to handle popup link configurations but lacks adequate validation checks before being processed or stored by the system.
The technical nature of this vulnerability classifies it as a Stored Cross-Site Scripting issue, commonly referred to in industry standards under CWE-79: Improper Neutralization of Input During Web Page Generation. Unlike reflected XSS where malicious scripts are executed immediately within an HTTP response, stored XSS involves persisting the injected payload on the target server, typically in a database or file system. When a victim user subsequently accesses a page containing this compromised data, the browser interprets and executes the embedded script as part of the legitimate web content. This persistence makes the attack particularly dangerous because it does not require tricking users into clicking specially crafted links; rather, any visitor to the affected pages will trigger the malicious code automatically upon loading.
A significant factor enabling this exploitation is the authentication bypass mechanism inherent in the plugin's design. Typically, actions that modify system settings or data require a valid WordPress nonce (nonces are unique tokens used to prevent Cross-Site Request Forgery) and user credentials. However, the VikRentCar plugin emits the vikwp_nonce token publicly on its booking-confirmation page accessible to unauthenticated visitors. This means an attacker does not need to compromise any administrator accounts or possess valid login credentials to interact with vulnerable endpoints. By simply visiting a public-facing page of the site, an attacker can retrieve this nonce and use it alongside their malicious payload in subsequent requests to successfully inject scripts into the system's storage.
The operational impact of such a vulnerability is severe for both website administrators and end-users. Once executed, arbitrary web scripts can perform various malicious actions depending on what permissions the victim user holds or what data is accessible within the browser context. Attackers may steal session cookies, hijack active sessions to impersonate legitimate users, redirect visitors to phishing sites designed to harvest credentials, deface the website by altering its appearance, or even deploy further malware through drive-by downloads. For a car rental business, this could lead to significant financial loss, reputational damage, and potential violation of data protection regulations if customer personal information is compromised during these attacks.
To mitigate this vulnerability, immediate action must be taken by site administrators using the affected versions of VikRentCar. The most effective remediation strategy is to upgrade the plugin to a version later than 1.4.9 where the developers have presumably addressed the input sanitization and output escaping deficiencies. If upgrading is not immediately possible due to compatibility constraints, temporary mitigations should be implemented at the web server or application firewall level to filter out suspicious characters associated with script injection in the poplink parameter. Additionally, implementing strict Content Security Policy headers can help limit the execution of unauthorized scripts even if an injection attempt succeeds, thereby reducing the blast radius of potential exploits until a permanent fix is applied.