VikRentCar WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Arbitrary File Upload

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the VikRentCar Car Rental Management System plugin for WordPress, affecting all versions through 1.4.2. The vulnerability arises from inadequate nonce validation in the 'save' function, allowing unauthenticated attackers to manipulate plugin access rights by tricking a site administrator into clicking a link. Exploitation of this vulnerability enables users with subscriber-level privileges or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Successful exploitation allows authenticated users with subscriber privileges and above to upload arbitrary files to the server, which could be used to execute malicious code remotely.

Remediation

Users are advised to update the VikRentCar WordPress plugin to version 1.4.3 or later.