EIP-2026-113620

This exploit demonstrates a time-based blind SQL injection vulnerability in the WordPress Car Park Booking plugin. The PoC uses the `space_id` parameter to inject a SLEEP(5) payload, confirming the vulnerability.