A cross‑site request forgery flaw exists in the VikRentCar WordPress plugin. An attacker who tricks an authenticated user into visiting a crafted URL can cause the user to submit requests that the plugin processes, potentially creating, editing, or deleting reservations, listings or other data. Because the vulnerability allows the attacker to act with the privileges of the logged‑in user, it grants unauthorized privilege escalation and can compromise the integrity and confidentiality of booking information.

The problem affects the e4jvikwp VikRentCar plugin for WordPress in all releases up to and including version 1.4.8. No minimum affected version is specified; any installation of the plugin older than 1.4.9 should be considered vulnerable.

The CVSS score of 8.8 indicates a high severity flaw. The EPSS score is not available, and it is not listed in the CISA KEV catalog, so the probability of exploitation is unknown but could be moderate. The flaw requires that an authenticated user visit a malicious page, which is a common and inexpensive attack vector for attackers with social‑engineering or phishing capabilities.