CVE-2026-88926

HighCVSS 8.6/10Last modified Sep 21, 2026

Description

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	VikRentItems Flexible Rental Management System	< 1.2.4

References

https://wpscan.com/vulnerability/da39827b-f087-48f3-baa9-759709a3767e/

Timeline

Published: Sep 19, 2026
Last modified: Sep 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-889274.3The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album CVE-2026-889286.5The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint w CVE-2026-889295.3The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published befor CVE-2026-88936.4The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-exp CVE-2026-889308.6The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by i CVE-2026-889315.3The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endp CVE-2026-889325.3multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage CVE-2026-889378.8knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to re CVE-2026-889386.5knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read s CVE-2026-889398.3knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypa CVE-2026-88946.4The iWR Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `iwrtooltip` shortcode in versions up to,CVE-2026-889405.3knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate ar