Motors <= 1.4.126 - Unauthenticated SQL Injection via Dealer Listing Taxonomy Parameter

ID

WPSEC-2026-1689

Plugin

Motors – Car Dealership & Classified Listings Plugin (motors-car-dealership-classified-listings)

Affected

all versions before 1.4.127

Remediation

Update to 1.4.127 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness

CWE-89

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27

Attack surface

Motors on WPSec AttackSurface

Fix released

2026-10-26

Published

2026-10-27

Description

The Motors plugin for WordPress is vulnerable to SQL Injection via the dealer listing taxonomy query-string parameters in all versions up to, and including, 1.4.126 due to insufficient escaping on the user supplied parameter key and insufficient preparation on the existing SQL query. The raw query-string parameter name was used to build SQL table aliases that were interpolated directly into the LEFT JOIN and WHERE clauses without escaping. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

References

• https://wpsec.com/vuln/WPSEC-2026-1689/
• https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/tags/1.4.127/
• https://wordpress.org/plugins/motors-car-dealership-classified-listings/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS