Motors Car Dealership EUVD-2026-89669

No special conditions beyond having the vulnerable plugin installed - remote unauthenticated exploitation against default configurations of the Motors - Car Dealership & Classified Listings Plugin for WordPress (all versions up to and including 1.4.109). Exploitation targets the 'stm_lat'/'stm_lng' parameters (latitude/longitude, tied to the plugin's location-based listing/search functionality), so the endpoint that processes these geo parameters must be reachable. Limiting factors: because this is time-based BLIND injection, data extraction is slow and noisy (one inference per timed request), and sites patched to 1.4.110 or later are not affected; no authentication, user interaction, or non-default setting is required.

This is a genuine, high-priority issue rather than an inflated-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction and high confidentiality impact, which for a blind SQL injection is fully consistent with the described ability to extract sensitive database contents (WordPress user records, password hashes, session/auth data). Integrity and availability are correctly scored N because time-based blind extraction reads data rather than modifying it. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - the risk is driven by the ease of the vector and the popularity of the plugin, not by observed in-the-wild activity. No SSVC decision data was supplied. The signals are internally consistent (no conflict between the network vector and the description, both indicate remote unauthenticated access), so the main open question is real-world exploitation likelihood, which for unauthenticated WordPress-plugin SQLi historically rises quickly once Wordfence details circulate.

An unauthenticated attacker sends crafted requests to the vulnerable endpoint, placing a time-based blind SQL payload in the 'stm_lat' or 'stm_lng' parameter, and infers database contents byte-by-byte from response-time differences. No public exploit code was identified at time of analysis, but the vector requires no authentication or user interaction, making automated mass scanning realistic once details are public.