WordPress Car Rental System plugin versions prior to 3.1 suffer from a remote SQL injection vulnerability.