CVE-2025-13724 is a SQL Injection vulnerability in the VikRentCar Car Rental Management System WordPress plugin (versions up to 1.4.4). It arises from improper neutralization of special elements in the 'month' parameter, enabling time-based blind SQL Injection attacks. Authenticated attackers with Administrator privileges can append malicious SQL queries to extract sensitive data from the backend database. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 7.5, indicating high severity. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated administrator-level user to perform time-based blind SQL Injection, potentially extracting sensitive information from the database. The vulnerability does not directly impact availability or integrity but compromises confidentiality. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'month' parameter. Avoid using vulnerable plugin versions in production environments if possible.