CVE-2026-111120：VikRentCar 車租借管理系統 1.4.8 版 CSRF 觸發遠端程式碼執行
CVE-2026-111120 - VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
VikRentCar WordPress 外掛 1.4.8 版因 CSRF 缺失 nonce，允許未授權者在管理員點選連結後寫入任意 PHP 程式碼，進而在伺服器上執行遠端程式碼。
此漏洞允許未授權者透過 CSRF 觸發 PHP 程式碼執行，需即時升級外掛以阻斷攻擊，並建議站長立即檢查管理員操作許可權，避免被利用。
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Impact
Affected Products
The following products are affected by CVE-2026-111120
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | E4jconnect | vikrentcar |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] |
Update the VikRentCar Car Rental Management System plugin to a version that addresses the CSRF vulnerability.
- Update the plugin to the latest available version.
- Apply vendor patches once released.
- Review and secure template file inclusions.
- Ensure administrator actions are protected.
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-111120.
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-111120 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-111120
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-111120 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-111120 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
十月. 28, 2026
Action Type Old Value New Value Added Description The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal <?php...?> payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-352 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/111xxx/CVE-2026-111120.json">CVE-2026-111120</a> Added Reference https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/controller.php#L9558 Added Reference https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/controller.php#L9609 Added Reference https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L1003 Added Reference https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L654 Added Reference https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/admin/helpers/conditional_rules.php#L765 Added Reference https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.8/site/helpers/lib.vikrentcar.php#L2685 Added Reference https://plugins.trac.wordpress.org/changeset?reponame=&old=3755596%40vikrentcar&new=3755596%40vikrentcar Added Reference https://www.wordfence.com/threat-intel/vulnerabilities/id/36f84246-6658-407a-88dd-4b99a784e682?source=cve
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.