CVE-2026-112836: WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability
Published Oct 20, 2026
·Updated
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8.
Affected Software
1 affected component
e4jvikwp VikRentCar<=1.4.8
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress VikRentCarto a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Oct 20, 2026
CVE Published
via MITRE·03:10 PM
Data Sourced
via MITRE·03:10 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an attacker to have an authenticated account?
No. The vulnerability is rated with no privileges required, indicating the attacker does not need prior authenticated access to exploit it.
2
Is user interaction required for exploitation?
Yes. The attack vector specifies that user interaction is required, consistent with a CSRF attack that relies on a victim performing an action.
3
What could a successful attack affect?
The vulnerability has high confidentiality, integrity, and availability impact ratings. Its scope is rated unchanged.