---
id: CVE-2017-20243
title: WordPress Car Park Booking Plugin SQL Injection via space_id
summary: >-
  WordPress Car Park Booking Plugin version 13 October 17 contains a time-based
  SQL injection vulnerability that allows unauthenticated attackers to
  manipulate database queries by injecting SQL code through the space_id
  parameter. Attacker…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: gurutechteam
product: Car Park Booking WordPress Plugin
affected:
  - car_park_booking_wordpress_plugin 13 October 17
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-09T14:08:34.168022Z'
exploitAvailable: true
published: '2026-06-09'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:00.315Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2017-20243'
references:
  - url: 'https://www.exploit-db.com/exploits/43012'
    label: ExploitDB-43012
  - url: 'https://codecanyon.net/item/car-park-booking-wordpress-plugin/20284035'
    label: Official Product Homepage
  - url: >-
      https://www.vulncheck.com/advisories/wordpress-car-park-booking-plugin-sql-injection-via-space-id
    label: >-
      VulnCheck Advisory: WordPress Car Park Booking Plugin SQL Injection via
      space_id
tags:
  - cve.org
  - exploit-available
epss: 0.00262
epssPercentile: 0.17969
ingestedAt: '2026-11-03T08:39:35.530Z'
---

## Overview

WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.

## Affected

- `car_park_booking_wordpress_plugin 13 October 17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.