SQL Injection Vulnerability in VikRentCar Car Rental Management System for WordPress

CVE-2025-13724

What is CVE-2025-13724?

The VikRentCar Car Rental Management System plugin for WordPress has a vulnerability that allows for time-based blind SQL injection through the 'month' parameter. This issue arises from improper escaping of user-supplied inputs and insufficient preparation of SQL queries. Authenticated users with Administrator-level access can exploit this vulnerability to append malicious SQL commands, potentially leading to unauthorized data access and extraction of sensitive information from the database.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References