VikRentCar Car Rental Management System: Cross-Site Request Forgery RCE (CVE-2026-111120)

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.4.8. The vulnerability exists due to missing or incorrect nonce validation within the condtext_update_tmpl function. This flaw allows an unauthenticated attacker to inject arbitrary PHP code into plugin template files, such as site/helpers/email_tmpl.php. When these files are subsequently processed by the loadEmailTemplate() or loadPdfTemplate() functions, the injected code is executed on the server. The vulnerability includes a mechanism where placeholders are expanded and sanitization is reversed, effectively restoring the malicious payload before it is written to the filesystem. Successful exploitation requires an attacker to trick a site administrator into clicking a malicious link.

Attack Chain

1. Attacker crafts a malicious request targeting the condtext_update_tmpl function.
2. Attacker embeds a PHP payload within the request parameters.
3. Attacker tricks a site administrator into performing a CSRF action (e.g., clicking a link) while they are authenticated.
4. The application processes the request, failing to validate a nonce.
5. The plugin logic reverses sanitization (e.g., cleanPHPSourceCode()), turning the payload into active PHP code.
6. The plugin writes the malicious PHP code to a template file on the server (e.g., email_tmpl.php).
7. The application invokes loadEmailTemplate() or loadPdfTemplate(), which includes and executes the injected PHP file, resulting in RCE.

Impact

Successful exploitation results in arbitrary remote code execution on the WordPress server, allowing an attacker to gain full control over the affected site.

Recommendation

• Update the VikRentCar Car Rental Management System plugin to the latest version that patches CVE-2026-111120.
• Audit plugin template directories for unexpected PHP content or modifications in site/helpers/.
• Monitor administrative access logs for unusual requests directed at condtext_update_tmpl actions.