CVE-2026-88926

VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

Affected

VikRentItems Flexible Rental Management System

CVSS v3.1 CNA

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.45% chance of exploitation in the next 30 days, 37th percentile

Published

2026-09-19

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/da39827b-f087-48f3-baa9-759709a3767e/

References

• CVE Record
• NVD entry