SQL Injection Vulnerability in VikRentCar Car Rental Management System for WordPress
CVE-2025-13724

7.5HIGH

Key Information:

Vendor: WordPress
Status: Vikrentcar Car Rental Management System
Vendor: CVE Published:; 2 December 2025

What is CVE-2025-13724?

The VikRentCar Car Rental Management System plugin for WordPress has a vulnerability that allows for time-based blind SQL injection through the 'month' parameter. This issue arises from improper escaping of user-supplied inputs and insufficient preparation of SQL queries. Authenticated users with Administrator-level access can exploit this vulnerability to append malicious SQL commands, potentially leading to unauthorized data access and extraction of sensitive information from the database.

Affected Version(s)

VikRentCar Car Rental Management System * <= 1.4.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/vikrentcar/tru...

https://plugins.trac.wordpress.org/browser/vikrentcar/tag...

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Dec 2, 2025
Vulnerability Reserved
Nov 25, 2025

Credit

zhenhua fan

JSON