{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vikrentcar-car-rental-management-system--1.4.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vikwp:vikrentcar:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-111120"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["VikRentCar Car Rental Management System (\u003c= 1.4.8)"],"_cs_severities":["high"],"_cs_tags":["web-application","cms","vulnerability","rce"],"_cs_type":"advisory","_cs_vendors":["VikWP"],"content_html":"\u003cp\u003eThe VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.4.8. The vulnerability exists due to missing or incorrect nonce validation within the \u003ccode\u003econdtext_update_tmpl\u003c/code\u003e function. This flaw allows an unauthenticated attacker to inject arbitrary PHP code into plugin template files, such as \u003ccode\u003esite/helpers/email_tmpl.php\u003c/code\u003e. When these files are subsequently processed by the \u003ccode\u003eloadEmailTemplate()\u003c/code\u003e or \u003ccode\u003eloadPdfTemplate()\u003c/code\u003e functions, the injected code is executed on the server. The vulnerability includes a mechanism where placeholders are expanded and sanitization is reversed, effectively restoring the malicious payload before it is written to the filesystem. Successful exploitation requires an attacker to trick a site administrator into clicking a malicious link.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious request targeting the \u003ccode\u003econdtext_update_tmpl\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eAttacker embeds a PHP payload within the request parameters.\u003c/li\u003e\n\u003cli\u003eAttacker tricks a site administrator into performing a CSRF action (e.g., clicking a link) while they are authenticated.\u003c/li\u003e\n\u003cli\u003eThe application processes the request, failing to validate a nonce.\u003c/li\u003e\n\u003cli\u003eThe plugin logic reverses sanitization (e.g., \u003ccode\u003ecleanPHPSourceCode()\u003c/code\u003e), turning the payload into active PHP code.\u003c/li\u003e\n\u003cli\u003eThe plugin writes the malicious PHP code to a template file on the server (e.g., \u003ccode\u003eemail_tmpl.php\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application invokes \u003ccode\u003eloadEmailTemplate()\u003c/code\u003e or \u003ccode\u003eloadPdfTemplate()\u003c/code\u003e, which includes and executes the injected PHP file, resulting in RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary remote code execution on the WordPress server, allowing an attacker to gain full control over the affected site.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the VikRentCar Car Rental Management System plugin to the latest version that patches CVE-2026-111120.\u003c/li\u003e\n\u003cli\u003eAudit plugin template directories for unexpected PHP content or modifications in \u003ccode\u003esite/helpers/\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor administrative access logs for unusual requests directed at \u003ccode\u003econdtext_update_tmpl\u003c/code\u003e actions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T08:27:40Z","date_published":"2026-10-28T08:27:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vikrentcar-csrf-rce/","summary":"The VikRentCar plugin for WordPress (\u003c= 1.4.8) contains a CSRF vulnerability in the condtext_update_tmpl function that permits unauthenticated attackers to achieve remote code execution by injecting PHP code into template files.","title":"VikRentCar Car Rental Management System: Cross-Site Request Forgery RCE (CVE-2026-111120)","url":"https://feed.craftedsignal.io/briefs/2026-10-vikrentcar-csrf-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - VikRentCar Car Rental Management System (\u003c= 1.4.8)","version":"https://jsonfeed.org/version/1.1"}