CVE-2026-111120— VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task

Quick assessment

Affected

e4jvikwp VikRentCar Car Rental Management System

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 VikRentCar Car Rental Management System 在所有 1.4.8 及更早版本中均存在跨站请求伪造（CSRF）漏洞。该漏洞源于函数中缺失或错误的 nonce 验证。这使得未认证的攻击者能够向插件的可执行模板文件（例如）写入任意 PHP 代码；这些文件随后会被和函数通过加载，从而在攻击者诱使站点管理员执行某些操作（如点击恶意链接）时，通过伪造的请求实现远程代码执行。注入的 PHP 载荷之所以能绕过清理机制，是因为插件自身的占位符展开逻辑以及函数

CVSS 8.8 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1562 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task

Source: CVE Program / CVE List V5

Vulnerability Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨站请求伪造(CSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
e4jvikwp	VikRentCar Car Rental Management System	0 ~ 1.4.8	-

II. Public POCs for CVE-2026-111120

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111120

请登录查看更多情报信息。

Other References for CVE-2026-111120 (8)

https://www.cve.org/CVERecord?id=CVE-2026-111120

Same Patch Batch · e4jvikwp · 2026-10-28 · 3 CVEs total

CVE-2026-116750	6.5 MEDIUM	VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injec
CVE-2026-116749	6.4 MEDIUM	VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cr

IV. Related Vulnerabilities

Same product: VikRentCar Car Rental Management System

Same vendor: e4jvikwp

Same weakness: CWE-352