# Motors <= 1.4.126 - Unauthenticated SQL Injection via Dealer Listing Taxonomy Parameter

- **ID:** WPSEC-2026-1689
- **Plugin:** Motors – Car Dealership & Classified Listings Plugin (`motors-car-dealership-classified-listings`), https://wordpress.org/plugins/motors-car-dealership-classified-listings/
- **Affected versions:** all versions before 1.4.127
- **Fixed in:** 1.4.127 (Update to 1.4.127 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/motors-car-dealership-classified-listings
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1689/

## Description

The Motors plugin for WordPress is vulnerable to SQL Injection via the dealer listing taxonomy query-string parameters in all versions up to, and including, 1.4.126 due to insufficient escaping on the user supplied parameter key and insufficient preparation on the existing SQL query. The raw query-string parameter name was used to build SQL table aliases that were interpolated directly into the LEFT JOIN and WHERE clauses without escaping. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-1689/
- https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/tags/1.4.127/
- https://wordpress.org/plugins/motors-car-dealership-classified-listings/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1689/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.