Live › vulnerability › CVE-2026-115964
The Motors car dealership and classifieds WordPress plugin (motors-car-dealership-classified-listings) by StylemixThemes has a blind SQL injection flaw in versions up to 1.4.126. Per WPSec, unauthenticated visitors can inject SQL through dealer listing taxonomy query-string parameters and read database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
WordPress sites running the Motors – Car Dealership & Classified Listings plugin at 1.4.126 or older, such as car dealership and classifieds sites. WPSec reports the flaw is reachable without logging in, through query-string parameters on dealer listing pages. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| motors-car-dealership-classified-listings | wordpress | <= 1.4.126 | 1.4.127 |
Update the Motors plugin to or later (released 2026-10-26).
1.4.127Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.
This page as .md · .json · in your agent: get_signal("CVE-2026-115964")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.