CVE-2026-116750
Tenable Plugin
Checking the public Tenable catalog…
AI Threat Summary
CVE-2026-116750 is a moderate vulnerability with a CVSS score of 6.5 affecting the target software. This vulnerability allows SQL injection leading to unauthorized data access. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.
Description
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can store a malicious block via the REST API in a pending post and trigger server-side rendering by previewing that post, bypassing wp_magic_quotes since the attribute is sourced from post_content via parse_blocks rather than a superglobal.
Attack Chain
Attacker identifies vulnerable service instances using Shodan, Censys, or active scanning
Attacker crafts malicious payload exploiting CVE-2026-116750 to achieve remote code execution
Attacker executes arbitrary OS commands or shellcode in the context of the vulnerable process
Attacker installs backdoor, cron job, or web shell for persistent access
Attacker uses compromised host as pivot point to access internal network resources
MITRE ATT&CK Techniques
Attacker exploits the vulnerability in an internet-facing service to gain initial access
Post-exploitation shell commands executed through the vulnerability
Attacker downloads malware or tools after gaining code execution
Indicators of Compromise
| Type | Value | Description | |
|---|---|---|---|
| user_agent | Mozilla/5.0 (compatible; exploit/1.0) |
Generic exploit scanner user agent pattern | |
| url | /api/vuln-endpoint?payload=<malicious> |
Exploit attempt against application endpoint — monitor access logs for anomalous params | |
| registry_key | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backdoor |
Persistence mechanism after successful RCE | |
| url | ' OR 1=1-- |
Classic SQL injection payload — monitor WAF and DB query logs |
Remediation
Quick Facts
| CVE ID | CVE-2026-116750 |
| CVSS Score | 6.5 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Published | 2026-10-28 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |