{"schema":"threatline.record/2","record":{"id":"CVE-2026-111120","aliases":[],"summary":"VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task","details":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.","categories":["Unclassified"],"product":"VikRentCar Car Rental Management System","vendor":"e4jvikwp","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111120","source_modified_at":"2026-10-28T06:45:10.550Z","fetched_at":"2026-10-28T08:18:35.509402Z","product":"VikRentCar Car Rental Management System","vendor":"e4jvikwp","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.4.8","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T06:45:10.550Z","modified_at":"2026-10-28T06:45:10.550Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111120","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-10-28T06:45:10.550Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f84246-6658-407a-88dd-4b99a784e682?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/controller.php#L9609"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/controller.php#L9558"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L1003"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L765"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L654"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/site/helpers/lib.vikrentcar.php#L2685"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3755596%40vikrentcar&new=3755596%40vikrentcar"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T06:45:10.550Z","content_hash":"4a646fd489b222c6caf61887a2f25aa148534a8d72993a6711dff1cd7f344cbe"}}