VikRentCar EUVD-2026-111609

Requires an authenticated WordPress account with contributor-level privileges or above (PR:L) on a site with VikRentCar Car Rental Management System ≤1.4.10 installed and active. The specific trigger is storing a malicious Gutenberg block via the REST API in a pending post and then previewing it to force server-side rendering of the vulnerable mod_vikrentcar_cars helper query; this path sources the injected 'catid' attribute from post_content via parse_blocks, which is what bypasses wp_magic_quotes sanitization that would otherwise apply to superglobal input. Limiting factors: no anonymous/unauthenticated exploitation (an attacker must first obtain a contributor account, so sites that disallow untrusted authoring are far less exposed), impact is confidentiality-only (blind data extraction, no write/integrity or availability impact), and the plugin must be present and active.

This is a moderate-priority, not emergency-tier, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity attack requiring low privileges (contributor-level WordPress account) with no user interaction, impacting confidentiality only - consistent with a blind SQL injection used to read database contents. The vuln.today decision label is 'this_month', indicating a planned-remediation priority rather than act_now/emergency. No CISA KEV listing is present, so there is no confirmed active exploitation, and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this input. No confirmed proof-of-concept exploit code is indicated either - the references are a Wordfence advisory and WordPress trac source listings, not a working exploit. The signals are internally consistent (authenticated-but-remote, confidentiality-only), so the main real-world limiter is the PR:L requirement: an attacker must first obtain a contributor-or-higher account, which makes this most relevant to multi-author sites and sites allowing untrusted registration. EPSS data is missing and should be checked against the live feed before final prioritization.

An attacker who holds (or registers/obtains) a contributor-level WordPress account on a site running VikRentCar ≤1.4.10 uses the REST API to store a malicious block containing a crafted 'catid' value inside a pending post, then previews that post to trigger server-side rendering and the vulnerable SQL query. Because the attribute is sourced from post_content via parse_blocks rather than a request superglobal, wp_magic_quotes is bypassed, and the blind SQL injection is used to incrementally extract sensitive data (e.g., user records and secrets) from the database. No public exploit was identified at time of analysis, and no user interaction from a victim is required.