SQL Injection Vulnerability in VikRentCar Car Rental Management System for WordPress

CVE-2025-13724

What is CVE-2025-13724?

The VikRentCar Car Rental Management System plugin for WordPress has a vulnerability that allows for time-based blind SQL injection through the 'month' parameter. This issue arises from improper escaping of user-supplied inputs and insufficient preparation of SQL queries. Authenticated users with Administrator-level access can exploit this vulnerability to append malicious SQL commands, potentially leading to unauthorized data access and extraction of sensitive information from the database.

References