CVE-2026-116750: VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can store a malicious block via the REST API in a pending post and trigger server-side rendering by previewing that post, bypassing wpmagicquotes since the attribute is sourced from postcontent via parseblocks rather than a superglobal.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They can create a pending post containing a malicious VikRentCar block through the REST API and trigger rendering by previewing that post.
Are sites affected under normal public-only access?
Unauthenticated visitors cannot directly exploit the issue based on the available information. Exposure depends on whether untrusted users can obtain or use Contributor-or-higher WordPress accounts.
What data could be exposed?
The SQL injection can be used to extract sensitive information from the WordPress database. The provided data does not establish that data can be modified or that service availability is affected.
How can administrators identify potentially affected activity?
Review pending posts and REST API-created content from Contributor-level or higher accounts for VikRentCar blocks with suspicious catid attribute values. Because the payload is stored in post content and executed when the post is previewed, preview activity for untrusted pending posts is particularly relevant.
What can be done before a fix is applied?
Restrict Contributor-or-higher access to trusted users, review or remove untrusted pending posts containing VikRentCar blocks, and avoid previewing such posts. Versions through 1.4.10 are affected according to the provided information.