CVE-2024-1845 is a high severity (CVSS 8.8) cross site request forgery flaw in the VikRentCar Car Rental Management System plugin for WordPress, in versions before 1.3.2. A logged in user can be tricked into unwanted actions. Update to version 1.3.2 or later, which WPScan lists as the fix.
What's affected
VikRentCar Car Rental Management System, WordPress plugin, all versions before 1.3.2. WPScan lists the fixed version as 1.3.2, so that is the first safe release.
The description says the plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions. The weakness is CWE-352, cross site request forgery. The record does not say which actions are exposed, and WPScan's page shows a booking cancellation or modification request as its example. I am not repeating the proof of concept.
The NVD vector requires user interaction, which matches how CSRF works: the victim must be logged in and must load a page or click a link the attacker controls. The record was published on 11 July 2024, later than most of the CVEs around it.
How to check if you're exposed
If you have WP-CLI, check the plugin version:
wp plugin list --fields=name,status,version,update | grep -i vikrentcar
Or look under Plugins in the WordPress admin. Any version before 1.3.2 is affected.
If you find an old version, look for signs it was abused. Review recent bookings and booking changes or cancellations that customers or staff did not ask for. Check the order history for modification requests that do not match a customer email or support ticket.
What to do now
- Check the installed plugin version.
- Update VikRentCar to 1.3.2 or later from the WordPress dashboard or with wp plugin update.
- Review recent booking changes and cancellations for anything unexpected.
- Ask staff to log out of the WordPress admin when they are not working in it, and avoid browsing other sites in the same session.
- Keep auto updates on for plugins that handle bookings and payments.
Why it matters
CSRF works because browsers attach your session cookie to requests to a site, no matter which page triggered the request. If the site does not check an unpredictable token, or the request origin, it cannot tell your click from a request that a malicious page made on your behalf.
The fix is straightforward: WordPress provides nonces for this purpose, and a plugin must verify one on every state changing action. The description says VikRentCar skipped those checks in some places.
The score is high because a successful request runs with the privileges of the victim. If the victim is a site administrator, the impact can include any action their account can take. Nothing retrieved says it is exploited in the wild, and the Known Exploited Vulnerabilities flag is false.
Quick check
Which version fixes CVE-2024-1845?
WPScan lists 1.3.2 as the fixed version. The NVD description says versions before 1.3.2 are affected.
Does the attacker need to log in?
No, but the victim does. The attacker relies on a logged in user loading a page they control.
Sources
Last reviewed: 19 October 2026.
