rootpwn

high · CVSS v3 8.6 · EPSS 0.00177

CVE-2026-88926

The VikRentItems Flexible Rental Management System plugin for WordPress prior to version 1.2.4 fails to properly sanitize and escape user-su

Overview

The VikRentItems Flexible Rental Management System plugin for WordPress prior to version 1.2.4 fails to properly sanitize and escape user-supplied parameters before incorporating them into SQL queries. This flaw enables unauthenticated remote attackers to execute arbitrary SQL commands against the underlying database. It matters because successful exploitation could lead to unauthorized access, data modification, or complete compromise of the WordPress site.

Description

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

Impact

This vulnerability impacts the confidentiality, integrity, and availability of the affected WordPress site. Unauthenticated malicious actors can leverage the SQL injection vector to read sensitive database contents, including user credentials and plugin data. Administrators and site owners are directly impacted as their web applications become susceptible to full database compromise and potential remote code execution chains.

Remediation

Update the VikRentItems Flexible Rental Management System plugin to version 1.2.4 or later immediately. Ensure that Web Application Firewalls (WAF) are configured to detect and block common SQL injection signatures targeting WordPress plugins. Review database query logs for unusual activities or unauthorized queries originating from unauthenticated sessions.

Risk context

The vulnerability carries a high CVSS v3 score of 8.6, reflecting its severity due to unauthenticated exploitation potential. While the current EPSS score is relatively low at 0.00177, public availability of the vulnerability necessitates prompt patching to prevent opportunistic attacks.

Affected products

  • E4J VikRentItems Plugin
  • WordPress VikRentItems Flexible Rental Management System

Scores

Severity
high
CVSS v2
7.8
CVSS v3
8.6
CVSS v4
—
EPSS
0.00177

SQL Injection WordPress Plugin Unauthenticated High Severity Web Application

← All CVEs

Related CVEs

high

CVE-2026-13354

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to inadequate sanitization of comment content. This flaw allows unauthenticated attackers to embed malicious scripts that execute in the browsers of users visiting affected pages.

View analysis

high

CVE-2026-76554

The WP Import Export Lite plugin for WordPress contains a privilege escalation vulnerability due to insufficient permission checks during the import process. Users with delegated access to the plugin can bypass standard WordPress role restrictions to create or modify user accounts, including administrators.

View analysis

high

CVE-2026-76790

The Estatik Real Estate Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 4.3.5. This vulnerability exists because the plugin fails to properly sanitize and escape specific request parameters before returning them in unauthenticated AJAX responses.

View analysis

high

CVE-2026-86814

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account. This flaw enables attackers to impersonate any account if they control the email via a provider account. It is a high severity vulnerability.

View analysis