{"id":"CVE-2026-111120","kind":"vulnerability","aliases":["CVE-2026-111120"],"related":[],"title":"WordPress VikRentCar plugin: forged admin request writes PHP, enabling server takeover","description":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.","summary":"The VikRentCar Car Rental Management System WordPress plugin up to and including 1.4.8 lacks nonce validation on its condtext_update_tmpl function. An unauthenticated attacker who tricks a site administrator into clicking a link can write PHP into template files that the plugin later includes, running code on the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["newer-than-1.4.8","plugin-not-installed"],"how_to_check":"- Check the installed VikRentCar plugin version in the WordPress admin Plugins screen or `wp plugin get vikrentcar --field=version` and see whether it is `1.4.8` or older.\n- Look for injected `<?php` content in the plugin's template files such as `site/helpers/email_tmpl.php` under the plugin directory.","fix":"- Update the VikRentCar Car Rental Management System plugin to a version later than `1.4.8` once the vendor releases a fix; the sources do not name the fixed version.\n- Until patched, deactivate the plugin or restrict admin access, and review the plugin's template files for unexpected PHP.","status":"open","published_at":"2026-10-28T07:16:46+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:32:44+00:00","updated_at":"2026-10-28T07:32:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T07:32:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the VikRentCar Car Rental Management System plugin to a version later than `1.4.8` once the vendor releases a fix; the sources do not name the fixed version.\n- Until patched, deactivate the plugin or restrict admin access, and review the plugin's template files for unexpected PHP.","reach":"internet","title":"WordPress VikRentCar plugin: forged admin request writes PHP, enabling server takeover","impact":"high","summary":"The VikRentCar Car Rental Management System WordPress plugin up to and including 1.4.8 lacks nonce validation on its condtext_update_tmpl function. An unauthenticated attacker who tricks a site administrator into clicking a link can write PHP into template files that the plugin later includes, running code on the server.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs PHP code on the server after luring an administrator","analyst_note":"Confirm the fixed plugin version and whether a patch has shipped; the NVD entry does not name one.","how_to_check":"- Check the installed VikRentCar plugin version in the WordPress admin Plugins screen or `wp plugin get vikrentcar --field=version` and see whether it is `1.4.8` or older.\n- Look for injected `<?php` content in the plugin's template files such as `site/helpers/email_tmpl.php` under the plugin directory.","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-than-1.4.8"],"who_is_affected":"Sites running the VikRentCar Car Rental Management System WordPress plugin at version 1.4.8 or earlier are exposed. Exploitation needs an administrator to be lured into a forged request, so sites with the plugin removed or on a newer version can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":3606,"output_tokens":681,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111120':14A,17A '-2026':13A,16A '/__php_close__':188C '1.4.8':38B,100C 'achiev':147C 'action':168C,225C 'addit':222C 'admin':5A 'administr':55B,164C,228C 'arbitrari':125C 'attack':50B,122C,230C 'bypass':179C 'cannot':231C 'car':28B,78C 'cleanphpsourcecod':192C 'click':57B,171C 'code':72B,127C,149C 'condtext':44B,112C 'cross':89C 'cross-sit':88C 'cve':12A,15A 'd':142C 'disk':219C 'due':103C 'enabl':9A 'encod':205C 'execut':132C,150C 'expans':190C 'explicit':194C 'exploit':221C 'field':199C 'file':65B,134C 'filter':200C 'forg':4A,156C 'forgeri':92C 'function':47B,115C 'grant':158C 'host':21B 'html':204C 'html-encod':203C 'includ':37B,70B,99C,141C 'incorrect':107C 'inject':176C 'lack':39B 'later':69B,140C 'link':59B,174C 'liter':208C 'live':212C 'loademailtempl':144C 'loadpdftempl':146C 'logic':193C 'make':117C 'manag':30B,80C 'miss':105C 'nonc':40B,108C 'open':187C 'packag':18B 'payload':178C,210C 'perform':166C 'php':8A,62B,126C,177C,186C,209C,213C 'placehold':189C 'plugin':3A,25B,33B,68B,82C,130C,183C 'possibl':119C 'remot':148C 'rental':29B,79C 'request':6A,91C,157C 'requir':223C 'restor':206C 'revers':195C 'run':71B 'sanit':180C,197C 'savehtml':202C 'self':20B 'self-host':19B 'server':10A,75B,153C 'site':54B,90C,163C 'site/helpers/email_tmpl.php':137C 'success':220C 'system':31B,81C 'takeov':11A 'templat':64B,133C 'text':198C 'tmpl':46B,114C 'trick':52B,161C 'trigger':232C 'unauthent':49B,121C 'updat':45B,113C 'valid':41B,109C 'version':95C 'via':154C 'vikrentcar':2A,27B,77C 'vulner':86C,234C 'wordpress':1A,22B,24B,32B,84C 'wordpress-plugin':23B 'write':7A,61B,124C 'written':217C","nicknames":[],"mitigations":[],"who_affected":"Sites running the VikRentCar Car Rental Management System WordPress plugin at version 1.4.8 or earlier are exposed. Exploitation needs an administrator to be lured into a forged request, so sites with the plugin removed or on a newer version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111120","severity":null,"published_at":"2026-10-28T07:16:46+00:00","modified_at":"2026-10-28T07:16:46+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}