CVE-2024-1845 VikRentCar Car Rental Management System < 1.3.2 - Cross Site Request Forgery
Attackers can trick logged-in users into performing unwanted actions in the VikRentCar WordPress plugin due to missing CSRF checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-1845?
CVE-2024-1845 is a high-severity vulnerability in Unknown VikRentCar Car Rental Management System, published on 11 Jul 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Weakness: CWE-352
Which versions are affected by CVE-2024-1845?
It affects 1 product.
Products include E4jconnect Vikrentcar.
How do I fix CVE-2024-1845?
No fix has been published for CVE-2024-1845 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-1845 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1845 exists.
Other vulnerabilities in Unknown VikRentCar Car Rental Management System
- CVE-2024-39653 WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerability
- CVE-2024-11640 Cross-site request forgery in VikRentCar Car Rental Management System
- CVE-2025-5322 VikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2023-23998 WordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-cgcx-7m9m-3qhm.