Threats tagged 'ghsa-v766-mw6j-539m'

The VikRentCar Car Rental Management System plugin for WordPress versions up to and including 1.4.8 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation. This vulnerability allows unauthenticated attackers to inject arbitrary PHP code into the plugin's executable template files by tricking an administrator into performing an action. The injected code bypasses sanitization and can lead to remote code execution on the server. Exploitation requires administrator interaction and cannot be triggered solely by the attacker.