CVE-2026-115964: WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
StylemixThemes Motors motors-car-dealership-classified-listingsto a version that resolves this vulnerability.Fixed in 1.4.127
Event History
Frequently Asked Questions
Which deployments are affected?
StylemixThemes Motors installations running versions through 1.4.126 are affected. The available data does not identify an earlier unaffected version.
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely impact of successful exploitation?
The issue permits blind SQL injection and is rated critical. The CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact.