VikRentCar CVE-2026-111120

Requires a target site running VikRentCar Car Rental Management System ≤1.4.8 and an authenticated site administrator who is tricked into performing an action (clicking a link / visiting a page) that issues the forged request to the condtext_update_tmpl function - the attacker cannot trigger it alone. No attacker authentication is needed (PR:N), but the mandatory admin interaction (UI:R) is the primary limiting factor. Exploitation is reliable against default configurations once the admin is lured, because the missing/incorrect nonce check and the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion plus cleanPHPSourceCode() logic deliberately reverse sanitize_text_field and saveHTML() encoding, restoring a literal <?php...?> payload to disk; no special non-default setting is required beyond having the plugin installed and active.

This is a genuine high-priority issue, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no attacker privileges but requiring user interaction, and the full C/I/A impact is justified because the outcome is arbitrary PHP write leading to remote code execution. The UI:R is concrete and material here: the CSRF cannot fire on its own - a logged-in site administrator must be tricked into issuing the forged request (e.g. clicking a link), which meaningfully narrows real-world exploitability versus a fully unauthenticated server-side RCE. No EPSS score is provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no confirmed public exploit code - the references are the Wordfence advisory plus WordPress plugin source/changeset links, not a working PoC - so there is no evidence of active exploitation. The vuln.today decision label is 'this_week', consistent with a serious-but-interaction-gated RCE rather than act_now/emergency. Net: prioritize patching within the week; the admin-interaction requirement and niche product footprint temper the raw 8.8 somewhat, but RCE potential keeps it firmly above routine.

An attacker crafts a malicious web page or email link containing a forged request to the plugin's condtext_update_tmpl function and lures a logged-in site administrator into visiting it. Because nonce validation is missing, the browser submits the request with the admin's session, writing attacker-controlled PHP into a template file such as site/helpers/email_tmpl.php, which is later include()d by loadEmailTemplate()/loadPdfTemplate() to execute the attacker's code on the server. No public exploit identified at time of analysis; exploitation hinges entirely on tricking an authenticated administrator (AV:N, AC:L, UI:R).