VikRentCar Car Rental Management System is vulnerable to a time‑based blind SQL injection through the 'month' parameter in all releases up to 1.4.4. The flaw stemmed from insufficient escaping and the lack of prepared statements, producing a classic SQL injection (CWE‑89). An authenticated attacker with Administrator privileges can append arbitrary SQL statements to the existing query, allowing extraction of sensitive data from the database. The injection being blind means the attacker must rely on timing or error responses to confirm success, yet the data exposed can be critical for further compromise or exfiltration.

All installations of VikRentCar Car Rental Management System for WordPress with version 1.4.4 or earlier are affected. No other vendors or products are listed.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1 % suggests exploitation is unlikely at present. The vulnerability is not listed in CISA KEV. The attack requires authenticated Administrator access; therefore, risk is markedly higher for sites with compromised credentials or exposed administrative interfaces, while the overall likelihood of exploitation remains low to moderate.