Live › vulnerability › CVE-2026-112836
Go to dashboardVikRentCar (WordPress car rental plugin by e4jvikwp) <= 1.4.8 lacks CSRF protection on admin actions. An attacker can trick a logged-in admin into submitting requests by getting them to open a malicious page. WPSec documents one affected action: customer document deletion, which can delete arbitrary files because the path is not validated. Fixed in 1.4.9, released 2026-10-19. No known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| vikrentcar | wordpress | <= 1.4.8 | 1.4.9 |
1.4.8 or lower is affected1.4.9 or later (wp plugin update vikrentcar)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-112836")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.