{
 "id": "WPSEC-2026-1689",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1689/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1689/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1689/index.md",
 "title": "Motors <= 1.4.126 - Unauthenticated SQL Injection via Dealer Listing Taxonomy Parameter",
 "description": "The Motors plugin for WordPress is vulnerable to SQL Injection via the dealer listing taxonomy query-string parameters in all versions up to, and including, 1.4.126 due to insufficient escaping on the user supplied parameter key and insufficient preparation on the existing SQL query. The raw query-string parameter name was used to build SQL table aliases that were interpolated directly into the LEFT JOIN and WHERE clauses without escaping. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
 "plugin": {
  "slug": "motors-car-dealership-classified-listings",
  "name": "Motors",
  "full_name": "Motors – Car Dealership & Classified Listings Plugin",
  "wordpress_org": "https://wordpress.org/plugins/motors-car-dealership-classified-listings/",
  "advisories_url": "https://wpsec.com/vuln/plugin/motors-car-dealership-classified-listings/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/motors-car-dealership-classified-listings"
 },
 "type": "SQLI",
 "cwe": [
  "CWE-89"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.127",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.127"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.127",
 "remediation": "Update to 1.4.127 or later.",
 "fix_released": "2026-10-26T04:27:11+00:00",
 "published": "2026-10-27T04:44:52+00:00",
 "updated": "2026-10-26T09:31:06.453519+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1689/",
  "https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/tags/1.4.127/",
  "https://wordpress.org/plugins/motors-car-dealership-classified-listings/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/motors-car-dealership-classified-listings",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}