The VikRentCar Car Rental Management System plugin for WordPress contains a flaw that permits uploading files of any type because the plugin's do_updatecar and createcar functions do not validate the MIME type or file extension. This is a classic improper file type validation weakness (CWE‑434). Attacker with Administrator or higher privileges can insert an executable or a malicious script onto the web server. Once placed in a directory that is served by the web server, the file can be accessed and run, allowing remote code execution or other destructive actions.

VikRentCar Car Rental Management System, published by e4jvikwp, for WordPress. Versions up to and including 1.4.3 are affected. The vulnerability is present in the plugin’s administrator‑only functions, so any installation of the plugin that uses these functions poses a risk.

The plugin’s CVSS score is 7.2, indicating a high severity. The EPSS score is 3 %, indicating a moderate likelihood that active exploitation is occurring and that this flaw may be targeted by attackers. It is not listed in the CISA KEV catalog. An attacker would need to be authenticated as Administrator or higher; there is no authentication bypass described. Once the arbitrary file is uploaded, the risk escalates immediately to remote code execution.