SQL Injection Vulnerability in Motors Plugin

WordPress

What happened

A vulnerability has been identified in the Motors plugin for WordPress, which allows for blind SQL injection due to improper handling of special elements used in SQL commands.

Are you affected?

Users of the Motors plugin for WordPress who are running versions 1.4.126 or earlier may be at risk.

What to do now

1. Upgrade to the latest version of the Motors plugin
2. Review your database for any unauthorized modifications
3. Monitor your site for unusual activity

Sources

• cve.now/CVE-2026-115964
• cve.now/GHSA-374V-VP9G-VWXH
• CVE-2026-115964
• GHSA-374V-VP9G-VWXH
• https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-126-sql-injection-vulnerability?_s_id=cve
• cve.now/GHSA-374v-vp9g-vwxh
• GHSA-374v-vp9g-vwxh
• https://nvd.nist.gov/vuln/detail/CVE-2026-115964

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.