{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vikrentcar--1.4.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:e4jvikwp:vikrentcar:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-112836"},{"cvss":7.1,"id":"CVE-2026-112838"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VikRentCar (\u003c= 1.4.8)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","wordpress","csrf","xss","plugin-security"],"_cs_type":"advisory","_cs_vendors":["e4jvikwp"],"content_html":"\u003cp\u003eA Cross-Site Request Forgery (CSRF) vulnerability exists in the VikRentCar plugin for WordPress, developed by e4jvikwp. The flaw, tracked as CVE-2026-112836, affects all versions from the inception of the plugin through 1.4.8. This vulnerability allows an unauthenticated, remote attacker to perform unauthorized actions by tricking an authenticated administrator into executing a malicious request via a crafted URL or web page. Successful exploitation of this flaw can lead to unauthorized configuration changes, potential loss of administrative control, or data modification within the WordPress environment, depending on the specific administrative actions the plugin permits through its CSRF-prone endpoints. Because this vulnerability targets the trust relationship between the user browser and the WordPress application, it poses a significant risk to the integrity of the site management panel.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target WordPress site running a vulnerable version of the VikRentCar plugin (\u0026lt;= 1.4.8).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request targeting a sensitive function within the VikRentCar plugin endpoint that lacks CSRF protection (e.g., token validation).\u003c/li\u003e\n\u003cli\u003eAttacker embeds the malicious request into a deceptive link or an iframe on an external website controlled by the attacker.\u003c/li\u003e\n\u003cli\u003eAn authenticated administrator with an active session in the WordPress dashboard visits the attacker-controlled website.\u003c/li\u003e\n\u003cli\u003eThe administrator's browser automatically includes active session cookies and makes the request to the target WordPress site.\u003c/li\u003e\n\u003cli\u003eThe VikRentCar plugin, failing to verify the request origin or session token, processes the administrative action as if requested by the authorized user.\u003c/li\u003e\n\u003cli\u003eThe target WordPress site completes the unauthorized configuration or administrative modification.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to perform administrative operations on behalf of an authenticated victim, leading to configuration changes, potential site takeover, or the creation of backdoors. Given the CVSS v3.1 score of 8.8, this vulnerability poses a critical impact to the availability and integrity of the affected WordPress application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the VikRentCar plugin to the version subsequent to 1.4.8 once the vendor releases a patch addressing CVE-2026-112836.\u003c/li\u003e\n\u003cli\u003eAudit access logs for suspicious administrative actions originating from unusual referrers or unexpected user-agent combinations.\u003c/li\u003e\n\u003cli\u003eImplement strict Content Security Policy (CSP) headers to mitigate potential CSRF and related injection vectors.\u003c/li\u003e\n\u003cli\u003eEnsure that the WordPress dashboard and plugin management interface are accessible only through restricted IP ranges or behind a VPN where feasible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T09:35:39Z","date_published":"2026-10-20T16:37:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vikrentcar-csrf/","summary":"A Cross-Site Request Forgery (CSRF) vulnerability in the VikRentCar WordPress plugin (versions 1.4.8 and earlier) allows unauthenticated attackers to perform unauthorized administrative actions.","title":"VikRentCar: Cross-Site Request Forgery (CVE-2026-112836)","url":"https://feed.craftedsignal.io/briefs/2026-10-vikrentcar-csrf/"}],"language":"en","title":"CraftedSignal Threat Feed - VikRentCar (\u003c= 1.4.8)","version":"https://jsonfeed.org/version/1.1"}