CVE-2026-116750 in VikRentCar Car Rental Management System Plugin
Summary
by MITRE • 10/28/2026
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can store a malicious block via the REST API in a pending post and trigger server-side rendering by previewing that post, bypassing wp_magic_quotes since the attribute is sourced from post_content via parse_blocks rather than a superglobal.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The VikRentCar plugin for WordPress presents a significant security risk due to a blind SQL injection vulnerability located within its car rental management functionality. This flaw affects all versions up to and including 1.4.10, stemming from insufficient input validation and sanitization mechanisms applied to the catid parameter. The core technical issue arises because user-supplied data is not adequately escaped before being incorporated into database queries, nor are prepared statements utilized to separate SQL logic from data inputs. This architectural deficiency allows malicious actors to manipulate the structure of backend SQL commands by injecting arbitrary code fragments that alter query execution paths.
The exploitation vector for this vulnerability requires authenticated access with at least contributor-level privileges or higher within the WordPress environment. While many vulnerabilities in web applications can be exploited by unauthenticated users, this specific flaw necessitates a lower-privileged account to initiate the attack sequence. The attacker leverages the REST API functionality of WordPress to store a malicious block containing SQL injection payloads within a post set to pending status. By previewing this post, which triggers server-side rendering processes, the attacker forces the application to process the injected payload through the parse_blocks function rather than standard superglobal input handlers like wp_magic_quotes. This bypass mechanism is critical because it allows the malicious code to evade certain legacy sanitization layers that typically protect against such injections in other contexts.
The operational impact of this vulnerability centers on the potential for unauthorized data extraction from the underlying database. Since the injection is blind, the attacker cannot directly view query results in the HTTP response but can infer information based on application behavior or timing differences. This capability enables the exfiltration of sensitive data such as user credentials, session tokens, configuration details, and other proprietary business logic stored within the WordPress database. The ability to append additional SQL queries means that an attacker could potentially escalate privileges by modifying administrative accounts or extracting encryption keys used for securing customer payment information associated with the car rental service.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and is categorized under ATT&CK technique T1059 Command and Scripting Interpreter via API abuse when leveraging the REST endpoint for initial access or payload delivery. The reliance on server-side rendering to trigger the injection highlights a complex interaction between frontend block editors and backend database operations, illustrating how modern WordPress plugin architectures can introduce subtle attack surfaces if input handling is not rigorously enforced across all entry points including AJAX handlers and preview mechanisms.
Mitigation strategies must prioritize immediate patching of the VikRentCar plugin to version 1.4.11 or later where these sanitization issues have been addressed by the developers. In environments where upgrading is not immediately feasible, administrators should restrict REST API access for lower-privileged users such as contributors and editors until the vulnerability is resolved. Implementing a Web Application Firewall with rules specifically tuned to detect SQL injection patterns in POST parameters related to car rental categories can provide an additional layer of defense. Furthermore, enforcing strict input validation that rejects any non-numeric characters in category ID fields would prevent the majority of injection attempts at the application boundary before they reach the database engine.