CVE-2026-115964: WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-29 · updated 2026-10-29
Weakness: CWE-89

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.

Summary

CVE-2026-115964 is a critical SQL injection flaw (CVSS 9.3) in the StylemixThemes Motors plugin for WordPress, a car dealership and classified listings plugin. The vulnerability allows blind SQL injection, which could let an attacker extract sensitive data from the site's database. All versions from n/a through 1.4.126 are affected. There is no evidence of active exploitation and it is not in CISA KEV, but the severity warrants prompt action: update to version 1.4.127 or later.

CVE-2026-115964 هو ثغرة حقن SQL حرجة (CVSS 9.3) في إضافة StylemixThemes Motors لـ WordPress، وهي إضافة لمواقع بيع السيارات والإعلانات المبوبة. تتيح الثغرة حقن SQL أعمى (Blind SQL Injection)، مما قد يمكّن المهاجم من استخراج بيانات حساسة من قاعدة بيانات الموقع. تتأثر جميع الإصدارات من n/a حتى 1.4.126. لا توجد أدلة على استغلال نشط ولم تُدرج في CISA KEV، لكن خطورة الثغرة تستدعي التحديث الفوري إلى الإصدار 1.4.127 أو أحدث.

Affected products

StylemixThemes Motors: through 1.4.126 — fixed in 1.4.127

How to fix

Upgrade to a fixed version: StylemixThemes Motors 1.4.127. Check the vendor advisory for mitigations.

References

https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-126-sql-injection-vulnerability?_s_id=cve

Get alerted when CVE-2026-115964 or the next vulnerability affects your stack