PT-2025-48656 · WordPress · Vikrentcar Car Rental Management System

Zhenhua Fan · Published 2025-12-02 · Updated 2025-12-02 · CVE-2025-13724

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VikRentCar Car Rental Management System plugin for WordPress versions through 1.4.4

Description The VikRentCar Car Rental Management System plugin for WordPress is susceptible to time-based blind SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically through the month parameter. Authenticated attackers with Administrator-level access or higher can append SQL queries to existing ones, potentially extracting sensitive information from the database.

Recommendations Update the VikRentCar Car Rental Management System plugin to a version later than 1.4.4.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-13724

Affected Products

Vikrentcar Car Rental Management System

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13724 · Security Note
• https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.4/admin/views/overv/view.html.php#L195 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/724a2da0-e4e7-4868-a1ad-fce69a915981?source=cve · Note
• https://twitter.com/CVEnew/status/1995778336321163318 · Twitter Post
• https://t.me/CVEtracker/38650 · Telegram Post
• https://plugins.trac.wordpress.org/browser/vikrentcar/trunk/admin/views/overv/view.html.php#L195 · Note
• https://twitter.com/VulmonFeeds/status/1995919360947372112 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3403439%40vikrentcar&new=3403439%40vikrentcar&sfp_email=&sfph_mail= · Note