WordPress Plugin Vulnerabilities

VikRentCar Car Rental Management System < 1.4.6 - Unauthenticated Insecure Direct Object Reference

Description

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.5 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
vikrentcar
Fixed in 1.4.6

References

CVE
CVE-2026-52699
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ce33f2a6-43a4-4382-97ff-9588e92b483d

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
dfe66db0-5e0f-4c3d-9386-8b21846aafa4

Timeline

Publicly Published
2026-06-10 (about 1 month ago)
Added
2026-06-18 (about 1 month ago)
Last Updated
2026-06-18 (about 1 month ago)

Other

Published
Title
Published
2025-12-03
Title
HUSKY – Products Filter Professional for WooCommerce < 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'
Published
2023-09-12
Title
wpDiscuz < 7.6.4 - Unauthenticated Data Modification via IDOR
Published
2026-04-27
Title
Booking Package < 1.7.07 - Unauthenticated Price Manipulation via 'amount' Parameter
Published
2023-04-10
Title
Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR
Published
2026-05-29
Title
Accept Stripe Payments < 2.0.99 - Unauthenticated Payment Bypass