# e4jconnect

Published articles for e4jconnect.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CVE-2026-111120 - VikRentCar Car Rental Management System \<= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext\_update\_tmpl' AJAX Task

DevFeed: [CVE-2026-111120 - VikRentCar Car Rental Management System \<= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext\_update\_tmpl' AJAX Task](<https://devfeed.tech/articles/cve-2026-111120-vikrentcar-car-rental-management-system-1-4-8-cross-site-request-forgery-to-remote-code-execution-via-condtext-update-tmpl-ajax-task-104134.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-111120>)

Author: CVEFEED.io; wordfence.com

Published: 2026-10-28T07:16:46Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [WordPress](<https://devfeed.tech/topics/wordpress.md>)

Tags: [1-4](<https://devfeed.tech/tags/1-4.md>), [code-execution](<https://devfeed.tech/tags/code-execution.md>), [cross](<https://devfeed.tech/tags/cross.md>), [cve-2026-111120](<https://devfeed.tech/tags/cve-2026-111120.md>), [e4jconnect](<https://devfeed.tech/tags/e4jconnect.md>), [vikrentcar](<https://devfeed.tech/tags/vikrentcar.md>)

### AI overview

VikRentCar for WordPress versions through 1.4.8 has a CSRF flaw in the condtext_update_tmpl AJAX task due to missing or incorrect nonce validation. An unauthenticated attacker can exploit it only by tricking an administrator into taking an action, such as clicking a link. The request can write PHP into executable template files; those files are later included by loadEmailTemplate() and loadPdfTemplate(), enabling remote code execution. The plugin's placeholder expansion and cleanPHPSourceCode() logic undo filtering and HTML encoding, allowing the payload to be restored as live PHP before it is written to disk.

### Source excerpt

CVE ID :CVE-2026-111120 Published : Oct. 28, 2026, 7:16 a.m. | 2 hours, 13 minutes ago Description :The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers to write arbitrary PHP code to the plugin's executable template files such as site/helpers/email_tmpl.php, which are later include()d by loadEmailTemplate() and loadPdfTemplate(), achieving remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The injected PHP payload bypasses sanitization because the plugin's own __PHP_OPEN__/__PHP_CLOSE__ placeholder expansion and cleanPHPSourceCode() logic explicitly reverse both sanitize_text_field filtering and saveHTML() HTML-encoding, restoring a literal payload to live PHP before it is written to disk. Successful exploitation additionally requires an action by an administrator -- the attacker cannot trigger the vulnerability on their own. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...