CVE-2026-88926: Unknown Vikrentitems Flexible Rental Management System

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

Affected products

• Unknown Vikrentitems Flexible Rental Management System: before 1.2.4 (fixed in 1.2.4)

Published 2026-09-19. Last modified 2026-09-21.