{"id":"CVE-2026-115964","published":"2026-10-29T11:17:31.220","lastModified":"2026-10-29T14:56:26.107","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-126-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Blind SQL injection in StylemixThemes Motors plugin allows attackers to infer database contents by sending crafted SQL payloads and observing response timing or content differences, potentially exposing sensitive data.","exploitability":"Exploitation requires no authentication or user interaction and is straightforward for an attacker with network access to the affected endpoint.","blast_radius":"Successful exploitation could lead to full compromise of backend database confidentiality via data extraction, while availability is moderately impacted due to time-based blind techniques.","remediation":"Upgrade to Motors version 1.4.127 or later, as this version contains the vendor's fix for the reported Blind SQL Injection vulnerability.","detection":"Defenders may observe delayed HTTP responses correlated with specific SQL injection payloads (e.g., SLEEP(), BENCHMARK(), or long-running queries) in web server access logs; however, no reliable host-based or network-based indicator is derivable from the published description.","tags":["sql-injection","blind-sqli","web","api"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:18:42.725Z"}}