VikRentCar EUVD-2026-36904

No special conditions - remote unauthenticated exploitation against default configurations of the VikRentCar WordPress plugin at versions 1.4.5 and earlier, per CVSS AV:N/AC:L/PR:N/UI:N. The only prerequisites are network reachability to a WordPress site that has the VikRentCar plugin installed and activated, and the ability to send HTTP requests that include a user-controlled object identifier (typically a numeric parameter in a plugin endpoint). Exploitation is limited to confidentiality impact (C:H/I:N/A:N), so an attacker can read other users' resources but cannot modify or destroy data through this flaw alone.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) indicates the flaw is remotely exploitable over the network with low complexity, no privileges, and no user interaction, yielding high confidentiality impact only - consistent with an unauthenticated data-disclosure IDOR. EPSS data and CISA KEV status are not provided in the input, and no public exploit is identified at this time, so real-world exploitation pressure cannot be quantified from the available signals. However, IDOR flaws in WordPress plugins are historically trivial to weaponize once an endpoint is identified, and the Patchstack disclosure increases the likelihood of opportunistic mass-scanning against WordPress sites running this plugin; the absence of integrity or availability impact slightly limits blast radius but does not reduce urgency for sites handling personal or booking data.

An unauthenticated attacker browses a WordPress site running VikRentCar, identifies a request that references a booking, reservation, or customer record by a numeric ID, and then iterates or substitutes that ID to retrieve records belonging to other customers. Because no authentication is required and the attack complexity is low, the attacker can script enumeration of sequential IDs to bulk-harvest sensitive rental data such as customer names, contact details, or booking specifics.