This vulnerability is a time‑based SQL injection in the QuanticaLabs Car Park Booking System plugin for WordPress. By submitting a malicious space_id value in a GET request to the booking-page endpoint, an attacker can execute arbitrary SQL statements that are run with the privileges of the WordPress database user. The result is that an unauthenticated visitor can read sensitive data from the database, exposing the site’s confidential information. Based on the description, it is inferred that the plugin does not validate or escape the space_id input, allowing the injection to succeed.

The affected product is the QuanticaLabs Car Park Booking System WordPress plugin, specifically the release dated 13 October 2017. The flaw exists in that version and in any earlier unpatched releases. Site owners who obtained the plugin from CodeCanyon, the WordPress repository or other third‑party sources should verify the installed version and determine whether a patched release is available.

The CVSS base score of 8.8 classifies the issue as high severity. The EPSS score is not available, so the current likelihood of exploitation is uncertain; however, the lack of authentication and the ability to confirm the injection with a simple SLEEP() payload suggest that an attacker can readily test for and exploit the flaw. The vulnerability is not listed in the CISA KEV catalog, but the potential for confidential data exposure and possible further attacks create a serious risk for affected sites.