CVE-2025-13724 identifies a time-based blind SQL Injection vulnerability in the VikRentCar Car Rental Management System WordPress plugin, versions up to and including 1.4.4. The vulnerability arises from improper neutralization of special characters in the 'month' parameter used within SQL queries. Specifically, the plugin fails to adequately escape or parameterize user-supplied input, allowing an attacker with Administrator-level privileges to inject additional SQL commands. This injection can be exploited to extract sensitive data from the backend database by leveraging time delays to infer information, a technique known as time-based blind SQL Injection. The vulnerability does not require user interaction and can be exploited remotely over the network (AV:N), with low attack complexity (AC:L), and no privileges required (PR:N) according to the CVSS vector, although the description states Administrator-level access is needed, indicating some discrepancy in the CVSS vector. The impact is primarily on confidentiality, with no direct effect on integrity or availability. No patches are currently available, and no known exploits have been reported in the wild. The vulnerability is classified under CWE-89, indicating improper neutralization of SQL commands. Given the plugin’s use in managing car rental services, exploitation could lead to unauthorized disclosure of customer data, booking information, or internal business data.

For European organizations using the VikRentCar plugin, this vulnerability poses a significant risk to the confidentiality of sensitive data, including customer personal information and booking records. Unauthorized data extraction could lead to privacy violations under GDPR, resulting in regulatory penalties and reputational damage. The requirement for Administrator-level access reduces the likelihood of external exploitation but raises concerns about insider threats or compromised admin accounts. Car rental businesses relying on this plugin may face operational risks if attackers leverage extracted data for fraud or competitive intelligence. Additionally, the breach of customer data could erode trust and impact business continuity. Given the widespread use of WordPress in Europe and the popularity of car rental services, the vulnerability could affect a broad range of organizations, particularly those in countries with large tourism sectors. The absence of known exploits currently provides a window for mitigation, but the high CVSS score (7.5) underscores the urgency of addressing the issue.

1. Monitor the vendor’s official channels for the release of a security patch and apply it immediately upon availability. 2. Until a patch is released, restrict Administrator-level access to trusted personnel only and enforce strong authentication mechanisms such as multi-factor authentication (MFA). 3. Implement Web Application Firewall (WAF) rules to detect and block suspicious SQL Injection patterns targeting the 'month' parameter. 4. Conduct regular security audits and code reviews of the plugin if custom modifications exist. 5. Employ database query parameterization and prepared statements in custom code to prevent injection. 6. Limit database user permissions to the minimum necessary to reduce the impact of potential exploitation. 7. Monitor logs for unusual query patterns or delays indicative of time-based blind SQL Injection attempts. 8. Educate administrators on the risks of SQL Injection and the importance of secure plugin management. 9. Consider temporarily disabling or replacing the VikRentCar plugin with alternative solutions if immediate patching is not feasible. 10. Backup databases regularly to ensure data recovery in case of compromise.