StylemixThemes Motors CVE-2026-54812

No special conditions - remote unauthenticated exploitation against default installations of the StylemixThemes Motors plugin (versions up to and including 1.4.109) on any WordPress site where the plugin is active and its listing/search endpoints are reachable over HTTP(S). Limiting factors are minimal: the site must have the Motors plugin installed and activated (a niche, paid car-dealership plugin rather than a default WordPress component), and the vulnerable endpoint must be exposed to the attacker - which is the normal deployment because listing/search functionality is public-facing by design. Blind SQLi requires many requests to extract data, so aggressive rate-limiting or a WAF in front of the site materially raises the cost of exploitation.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L is a high-severity profile: network-reachable, low complexity, no privileges, no user interaction, with scope change and high confidentiality impact - typical of unauthenticated SQLi in a WordPress plugin. EPSS data was not supplied in the input, and CISA KEV does not list this CVE, so there is no confirmed evidence of active exploitation; likewise, no public POC is identified at time of analysis. The reporter is Patchstack, a credible WordPress vulnerability source, which raises confidence that the finding is real even though only a single reference is provided. Defenders should treat this as a real priority because automated SQLi scanners frequently weaponize Patchstack disclosures for WordPress plugins within days of publication, even when EPSS has not yet caught up.

An unauthenticated attacker discovers a WordPress site running the Motors plugin (often identifiable via theme fingerprints or specific URL paths) and sends crafted HTTP requests to a vulnerable Motors endpoint, embedding boolean- or time-based SQL inference payloads in parameters such as search filters or listing IDs. Through repeated requests, the attacker exfiltrates sensitive data from the WordPress database, including the wp_users table containing password hashes and email addresses, ultimately enabling credential cracking and full site takeover. No public POC has been identified at time of analysis, but automated tools such as sqlmap can typically be pointed at the vulnerable parameter once the endpoint is published.