{"id":"CVE-2026-112836","kind":"vulnerability","aliases":["CVE-2026-112836"],"related":[],"title":"VikRentCar WordPress plugin: CSRF lets attackers act as admin","description":"Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.","summary":"VikRentCar (WordPress car rental plugin by e4jvikwp) <= 1.4.8 lacks CSRF protection on admin actions. An attacker can trick a logged-in admin into submitting requests by getting them to open a malicious page. WPSec documents one affected action: customer document deletion, which can delete arbitrary files because the path is not validated. Fixed in 1.4.9, released 2026-10-19. No known exploitation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vikrentcar","fixed":["1.4.9"],"affected":"<= 1.4.8","ecosystem":"wordpress"}],"ecosystems":[],"tags":["csrf","package","vikrentcar","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-1.4.9-or-later","version-above-1.4.8"],"how_to_check":"WordPress admin > Plugins: VikRentCar version 1.4.8 or lower is affected. With WP-CLI: wp plugin get vikrentcar --field=version","fix":"Update VikRentCar to 1.4.9 or later (wp plugin update vikrentcar). Until then, log out of wp-admin when browsing other sites.","status":"open","published_at":"2026-10-20T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:32:49+00:00","updated_at":"2026-10-24T00:13:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:32:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VikRentCar WordPress plugin: CSRF lets attackers act as admin","impact":"medium","summary":"VikRentCar is a WordPress car rental plugin, and versions up to 1.4.8 have a cross-site request forgery flaw. A logged-in administrator who opens a malicious page could be tricked into performing actions on the site, such as changing settings or data.","category":"package","who_cares":["wordpress","vikrentcar"],"confidence":0.6,"needs_auth":"yes","worst_case":"logged-in admin actions are performed without consent","analyst_note":"Confirm the patched version and which admin actions are exposed; the NVD entry gives no fixed release.","how_to_check":"Check the installed VikRentCar version in the WordPress admin plugins list; anything 1.4.8 or older is affected.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-1.4.8"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":2907,"output_tokens":372,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patched version and which admin actions are exposed; the NVD entry gives no fixed release.","search":"'-10':82B '-112836':12A,15A '-19':83B '-2026':11A,14A '1.4.8':31B,109C '1.4.9':79B '2026':81B 'act':7A 'action':37B,62B 'admin':9A,36B,46B 'affect':61B,104C 'allow':98C 'arbitrari':69B 'attack':6A,39B 'car':26B 'cross':88C,99C 'cross-sit':87C 'csrf':4A,17B,33B,92C 'custom':63B 'cve':10A,13A 'delet':65B,68B 'document':59B,64B 'e4jvikwp':30B,95C 'exploit':86B 'file':70B 'fix':77B 'forgeri':91C 'forgery.this':102C 'get':51B 'issu':103C 'known':85B 'lack':32B 'let':5A 'log':44B 'logged-in':43B 'malici':56B 'n/a':107C 'one':60B 'open':54B 'packag':18B 'page':57B 'path':73B 'plugin':3A,23B,28B 'protect':34B 'releas':80B 'rental':27B 'request':49B,90C,101C 'site':89C,100C 'submit':48B 'trick':41B 'valid':76B 'vikrentcar':1A,16A,19B,24B,96C,97C,105C 'vulner':93C 'wordpress':2A,20B,22B,25B 'wordpress-plugin':21B 'wpsec':58B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112836","severity":null,"published_at":"2026-10-20T16:17:04+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112836:615","url":null,"severity":null,"published_at":"2026-10-24T00:13:51+00:00","modified_at":"2026-10-24T00:13:51+00:00","first_seen_at":"2026-10-24T00:13:51+00:00","fetched_at":"2026-10-24T00:13:51+00:00","note":"CVE record + cvefeed (Patchstack-sourced): affected through 1.4.8, fixed 1.4.9. Exact vulnerable action not named in the CVE; WPSec WPSEC-2026-1308 describes a CSRF in delete_customer_document (arbitrary file deletion, 1.2.0-1.4.8, fixed 1.4.9, released 2026-10-19), possibly the same or a sibling issue, unconfirmed. No exploitation or PoC found; not in KEV. CVSS 8.8 per CNA; vuln.today argues the realistic impact is lower. No social discussion checked."}],"documents":[{"id":2485,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112836","title":"CVE Record: CVE-2026-112836 (unaffected from 1.4.9)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2482,"url":"https://cvefeed.io/vuln/detail/CVE-2026-112836","title":"CVE-2026-112836 VikRentCar <= 1.4.8 (Patchstack source; update to 1.4.9)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2484,"url":"https://wpsec.com/vuln/WPSEC-2026-1308/","title":"WPSEC-2026-1308 VikRentCar <= 1.4.8 CSRF to arbitrary file deletion (fixed 1.4.9, 2026-10-19)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}