What is the CVSS score of CVE-2026-54812?

CVE-2026-54812 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of StylemixThemes Motors are affected by CVE-2026-54812?

An unauthenticated SQL injection vulnerability in the StylemixThemes Motors WordPress plugin (versions ≤1.4.109) enables attackers to directly exfiltrate the entire WordPress database without…

How to fix or mitigate CVE-2026-54812?

24 hours: Audit all WordPress installations for Motors plugin presence (wp-cli: 'wp plugin list --name=motors'); immediately deactivate any version ≤1.4.109 and document affected business processes. 7 days: Deploy WAF rules (ModSecurity/Cloudflare/AWS WAF) blocking SQL injection patterns (union select, or 1=1, etc.); implement IP whitelisting for plugin administrative access. 30 days: Monitor StylemixThemes for patch release to version 1.4.110+; if unavailable, execute migration to alternative classified listings plugin (WP Classifieds, Classified Listings, Motors Easy).

StylemixThemes Motors CVE-2026-54812

CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Motors Stylemixthemes

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi against a WordPress plugin: AV:N/AC:L/PR:N/UI:N; blind SQLi yields high confidentiality and limited integrity via DB writes, no availability impact, scope unchanged within wpdb.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 15:34 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors allows Blind SQL Injection.

This issue affects Motors: from n/a through 1.4.109.

AnalysisAI

Blind SQL injection in the StylemixThemes Motors WordPress plugin (versions up to and including 1.4.109) allows remote unauthenticated attackers to inject crafted SQL fragments into backend queries, leading to confidentiality compromise of the WordPress database and limited availability impact. The CVSS 3.1 base score of 9.3 reflects a scope change (S:C), meaning the impact extends beyond the plugin to the underlying database engine shared with the WordPress core. No public exploit identified at time of analysis, but the SQLi class and unauthenticated network vector make this a high-priority issue for sites running the Motors car dealership/classified listings plugin.

Technical ContextAI

The affected component is the Motors plugin by StylemixThemes (CPE cpe:2.3:a:stylemixthemes:motors), a commercial WordPress theme/plugin used for car dealership and classified-listings websites. The root cause is CWE-89: Improper Neutralization of Special Elements used in an SQL Command, meaning user-controlled input is concatenated into SQL queries executed by the WordPress wpdb layer without parameterization or proper escaping (e.g., missing $wpdb->prepare or unsanitized usage of esc_sql). Because the variant is described as 'Blind SQL Injection,' the vulnerable endpoint likely does not return query results directly, so attackers must rely on boolean-based or time-based inference techniques to extract data row by row.

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version greater than 1.4.109 is implied but not independently confirmed from the supplied data, so administrators should upgrade the Motors plugin to the latest available version published by StylemixThemes via the WordPress dashboard or the vendor portal, consulting https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-109-sql-injection-vulnerability for the exact fix version. If immediate upgrade is not feasible, deploy a WAF rule (Patchstack vPatch, Wordfence, or equivalent) that blocks SQLi payloads against Motors plugin endpoints, restrict access to Motors-specific URLs (e.g., AJAX actions and listing search endpoints) to authenticated users via .htaccess or Nginx rules - accepting that this will break public listing search functionality - and enable database query logging to detect inference-based probing. Deactivating the plugin entirely is the highest-confidence mitigation but removes all dealership/listing features from the site.