{"id":"CVE-2026-115964","kind":"vulnerability","aliases":["CVE-2026-115964"],"related":[],"title":"StylemixThemes Motors WordPress theme: blind SQL injection lets attackers read database","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.","summary":"The Motors car dealership and classifieds WordPress plugin (motors-car-dealership-classified-listings) by StylemixThemes has a blind SQL injection flaw in versions up to 1.4.126. Per WPSec, unauthenticated visitors can inject SQL through dealer listing taxonomy query-string parameters and read database contents.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"motors-car-dealership-classified-listings","fixed":["1.4.127"],"affected":"<= 1.4.126","ecosystem":"wordpress"}],"ecosystems":[],"tags":["car-dealership-sites","motors","motors-theme","runtime","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","theme-not-installed","version-1.4.127-or-later"],"how_to_check":"- WordPress admin > Plugins: check the version of 'Motors – Car Dealership & Classified Listings Plugin'; 1.4.126 or older is affected\n- Or read the Version header in wp-content/plugins/motors-car-dealership-classified-listings/motors-car-dealership-classified-listings.php","fix":"Update the Motors plugin to 1.4.127 or later (released 2026-10-26).","status":"open","published_at":"2026-10-29T11:17:31+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","triaged_at":"2026-10-29T11:25:25+00:00","updated_at":"2026-10-29T11:26:53+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-29T11:25:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"StylemixThemes Motors WordPress theme: blind SQL injection lets attackers read database","impact":"high","summary":"The Motors car dealership and classifieds WordPress theme by StylemixThemes has a blind SQL injection flaw in versions up to and including 1.4.126. An attacker can send crafted requests to query the site's database and infer its contents.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","motors-theme","car-dealership-sites"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads database contents, including user and credential data","analyst_note":"Check the NVD entry and the StylemixThemes changelog for a fixed version and whether authentication is required.","how_to_check":"- Check the installed version of the Motors theme (motors-car-dealership-classified-listings) in the WordPress admin under Appearance > Themes, or in the theme's style.css\n- Flag sites where the version is `1.4.126` or older","plain_action":"","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the Motors car dealership and classifieds WordPress theme at version 1.4.126 or earlier are exposed. The sources do not say which configuration or pages are needed to trigger the flaw, so unknown whether logged-out visitors can reach it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000681,"input_tokens":4127,"output_tokens":537,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the StylemixThemes changelog for a fixed version and whether authentication is required.","search":"'-115964':14A,17A '-2026':13A,16A '1.4.126':63B,115C 'affect':110C 'allow':105C 'attack':9A 'blind':5A,55B,106C 'car':20A,25B,39B,47B,101C 'car-dealership-sit':24B 'classifi':42B,49B,103C 'classified':22A 'command':92C 'content':82B 'cve':12A,15A 'databas':11A,81B 'dealer':72B 'dealership':21A,26B,40B,48B,102C 'element':87C 'flaw':58B 'improp':83C 'inject':7A,57B,69B,94C 'injection.this':108C 'issu':109C 'let':8A 'list':50B,73B,104C 'listings':23A 'motor':2A,28B,30B,38B,46B,98C,100C,111C 'motors':19A 'motors-car-dealership-classified-list':45B,99C 'motors-car-dealership-classified-listings':18A 'motors-them':29B 'n/a':113C 'neutral':84C 'paramet':78B 'per':64B 'plugin':36B,44B 'queri':76B 'query-str':75B 'read':10A,80B 'runtim':32B 'site':27B 'special':86C 'sql':6A,56B,70B,91C,93C,107C 'string':77B 'stylemixthem':1A,52B,97C 'taxonomi':74B 'theme':4A,31B 'unauthent':66B 'use':88C 'version':60B 'visitor':67B 'vulner':95C 'wordpress':3A,33B,35B,43B 'wordpress-plugin':34B 'wpsec':65B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Motors – Car Dealership & Classified Listings plugin at 1.4.126 or older, such as car dealership and classifieds sites. WPSec reports the flaw is reachable without logging in, through query-string parameters on dealer listing pages. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115964","severity":null,"published_at":"2026-10-29T11:17:31+00:00","modified_at":"2026-10-29T11:17:31+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","fetched_at":"2026-10-29T11:24:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115964:1013","url":null,"severity":null,"published_at":"2026-10-29T11:26:53+00:00","modified_at":"2026-10-29T11:26:53+00:00","first_seen_at":"2026-10-29T11:26:53+00:00","fetched_at":"2026-10-29T11:26:53+00:00","note":"Correction: this is the Motors plugin (motors-car-dealership-classified-listings), not a theme. WPSec advisory WPSEC-2026-1689 (same <=1.4.126 range, likely same issue; CVE id not stated there) says unauthenticated SQLi via dealer listing taxonomy query-string parameter names, fixed in 1.4.127 (2026-10-26). Not vendor's own words, so nothing marked verified. No exploitation or PoC found. Separate older CVE-2026-54812/6806 covers <=1.4.109."}],"documents":[{"id":16109,"url":"https://wpsec.com/vuln/WPSEC-2026-1689/","title":"WPSec: Motors <= 1.4.126 Unauthenticated SQL Injection via Dealer Listing Taxonomy Parameter","kind":"advisory","source":"analyst","publisher":null,"text":"Affected: all versions before 1.4.127. Fixed in 1.4.127 (released 2026-10-26). Unauthenticated; raw query-string parameter names on dealer listing taxonomy used in SQL table aliases in LEFT JOIN/WHERE. CVSS 7.5 AV:N/PR:N.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16110,"url":"https://wordpress.org/plugins/motors-car-dealership-classified-listings/","title":"Motors plugin page, wordpress.org (last modified 2026-10-26)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}