---
id: "CVE-2026-112836"
kind: "vulnerability"
aliases: ["CVE-2026-112836"]
title: "VikRentCar WordPress plugin: CSRF lets attackers act as admin"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "vikrentcar", "fixed": ["1.4.9"], "affected": "<= 1.4.8", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["csrf", "package", "vikrentcar", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "version-1.4.9-or-later", "version-above-1.4.8"]
published_at: "2026-10-20T16:17:04+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:13:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112836", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:13:51+00:00"}]
---

# VikRentCar WordPress plugin: CSRF lets attackers act as admin

VikRentCar (WordPress car rental plugin by e4jvikwp) <= 1.4.8 lacks CSRF protection on admin actions. An attacker can trick a logged-in admin into submitting requests by getting them to open a malicious page. WPSec documents one affected action: customer document deletion, which can delete arbitrary files because the path is not validated. Fixed in 1.4.9, released 2026-10-19. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:vikrentcar affected <= 1.4.8 fixed 1.4.9

## How to check

WordPress admin > Plugins: VikRentCar version 1.4.8 or lower is affected. With WP-CLI: wp plugin get vikrentcar --field=version

## Fix

Update VikRentCar to 1.4.9 or later (wp plugin update vikrentcar). Until then, log out of wp-admin when browsing other sites.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112836
- 2026-10-24T00:13:51+00:00 analyst — CVE record + cvefeed (Patchstack-sourced): affected through 1.4.8, fixed 1.4.9. Exact vulnerable action not named in the CVE; WPSec WPSEC-2026-1308 describes a CSRF in delete_customer_document (arbitrary file deletion, 1.2.0-1.4.8, fixed 1.4.9, released 2026-10-19), possibly the same or a sibling issue, unconfirmed. No exploitation or PoC found; not in KEV. CVSS 8.8 per CNA; vuln.today argues the realistic impact is lower. No social discussion checked.

## Documents

- [advisory] CVE Record: CVE-2026-112836 (unaffected from 1.4.9) https://www.cve.org/CVERecord?id=CVE-2026-112836
- [fix] CVE-2026-112836 VikRentCar <= 1.4.8 (Patchstack source; update to 1.4.9) https://cvefeed.io/vuln/detail/CVE-2026-112836
- [mentions] WPSEC-2026-1308 VikRentCar <= 1.4.8 CSRF to arbitrary file deletion (fixed 1.4.9, 2026-10-19) https://wpsec.com/vuln/WPSEC-2026-1308/

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_