CVE-2026-52699

Vulnerability

VikRentCar plugin for WordPress versions 1.4.5 and earlier contain an Insecure Direct Object Reference (IDOR) vulnerability [1]. The vulnerability is unauthenticated, meaning no authentication is required to exploit it. The plugin fails to properly validate user access to direct object references, allowing unauthorized access.

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests to manipulate object references (e.g., IDs) without authorization checks [1]. No prior authentication or user interaction is required.

Impact

Successful exploitation could allow an attacker to bypass authorization and access sensitive files/folders or interact with the database, potentially leading to information disclosure or data manipulation [1]. The vulnerability could be used in mass-exploit campaigns against thousands of websites.

Mitigation

The vulnerability is fixed in version 1.4.6 [1]. Users should update to version 1.4.6 or later immediately. As an interim measure, Patchstack provides a mitigation rule to block attacks until the update is applied [1].