CVE-2025-5322
VikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
| CWE | CWE-434 |
| Vendor | e4jvikwp |
| Product | vikrentcar car rental management system |
| Published | Jul 3, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for e4jvikwp vikrentcar car rental management system
Be the first to know when new high vulnerabilities affecting e4jvikwp vikrentcar car rental management system are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
e4jvikwp / VikRentCar Car Rental Management System
0 ≤ 1.4.3
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/5f837ba2-64a2-4d8e-8212-b646cb94b0d7?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.3/admin/controller.php#L1698 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.3/admin/controller.php#L1418 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3317493/
Credits
Jonas Benjamin Friedli