VikRentCar CVE-2026-112836

Exploitation requires that a privileged user (typically a logged-in WordPress administrator) with an active authenticated session be tricked into interacting with attacker-controlled content (UI:R) - e.g., clicking a crafted link or loading a malicious page - while the targeted VikRentCar action lacks anti-CSRF nonce validation. Limiting factors: the attack cannot succeed without this authenticated victim interaction, so it is not purely unauthenticated despite PR:N; it depends on the victim being logged in at the time, on the absence/bypass of WordPress nonce protection in the vulnerable 1.4.8-and-earlier code, and on the site actually running the VikRentCar plugin. The attacker cannot read the response, limiting data exfiltration.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) scores this high, but the signals do not all point the same way and the triple-High impact is characteristic of Patchstack's generous CSRF scoring rather than an independently verifiable outcome. The flaw is CWE-352 (CSRF), which by definition requires UI:R - a logged-in privileged user (typically a WordPress administrator) must be lured into triggering a forged request - so despite PR:N and AV:N this is not drive-by, unauthenticated-at-will exploitation; it is conditional on social engineering of a privileged victim. No EPSS score was provided, the vulnerability is NOT in CISA KEV, and no POC or exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. Net: this is a moderate real-world priority - genuinely exploitable but gated on tricking an authenticated admin, not a mass-exploitable network bug. CONFLICT TO VERIFY: the C:H rating is questionable because classic CSRF does not return response data to the attacker (the attacker cannot read confidential output), so confidentiality impact is likely overstated - verify actual impact with the Patchstack advisory.

An attacker crafts a malicious web page or email containing a forged request targeting a VikRentCar admin action and lures a logged-in WordPress administrator into visiting it. Because the plugin does not validate an anti-CSRF nonce, the victim's browser submits the request with valid session cookies, causing an unwanted state-changing action (e.g., modifying plugin settings or booking data) under the admin's authority. No public exploit code is identified at time of analysis; the attack requires user interaction (UI:R) by a privileged victim.