CVE-2024-11640 is a CSRF vulnerability in the VikRentCar Car Rental Management System WordPress plugin (up to version 1.4.2). The issue arises from missing or incorrect nonce validation in the 'save' function, allowing attackers to forge requests that change plugin access privileges if an administrator is tricked into performing an action. Attackers with subscriber-level or higher privileges can exploit this to upload arbitrary files to the affected server, potentially leading to remote code execution. The vulnerability is publicly known and assigned a high CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with subscriber-level privileges or above to upload arbitrary files to the server hosting the vulnerable plugin. This can lead to remote code execution, compromising the affected system's confidentiality, integrity, and availability. The vulnerability requires user interaction (an administrator being tricked) but does not require prior authentication beyond subscriber-level access. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict user privileges to trusted users only and avoid clicking on suspicious links or performing untrusted actions. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming official fixes promptly.