The vulnerability is a blind SQL injection in the catid parameter of VikRentCar Car Rental Management System up to release 1.4.10. Insufficient escaping and lack of prepared statements allow an attacker to inject arbitrary SQL. An authenticated contributor-level user can store malicious blocks via the REST API, preview them, and trigger server‑side rendering. This can append additional SQL statements to the existing query, enabling extraction of sensitive database content such as booking data or user credentials. The weakness is CWE-89, representing an injection flaw.

All installations of VikRentCar Car Rental Management System version 1.4.10 or earlier on WordPress are affected. The plugin was provided by the vendor e4jvikwp. No other versions are listed as vulnerable; the newer 1.4.11 release contains a fix that sanitizes the catid parameter.

The CVSS score of 6.5 indicates moderate severity. An attacker must be authenticated with contributor‑level access to exploit the flaw; therefore, the vulnerability is not remotely exploitable by unauthenticated users. The EPSS score is not available, and the flaw is not currently listed in CISA’s KEV catalog, suggesting a lower known exploitation probability at this time. However, because the injection can retrieve arbitrary database data, the potential impact on confidentiality remains significant. The likely attack vector is application‑layer exploitation via the REST API and block preview functionality, and the attacker needs to have a pending post containing malicious code.