CVE-2025-5322 is a vulnerability in the VikRentCar Car Rental Management System WordPress plugin (up to version 1.4.3) that allows authenticated users with Administrator privileges to upload arbitrary files. The root cause is the lack of file type validation in the do_updatecar and createcar functions. This unrestricted file upload can enable attackers to place malicious files on the server, potentially leading to remote code execution. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. No patch or official fix has been published yet, and the product is not a cloud service, so remediation depends on vendor updates or user intervention.

An attacker with Administrator-level access can upload arbitrary files to the server hosting the VikRentCar plugin. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions up to and including 1.4.3. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.