CVE-2026-54812: WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability

Synopsis

A SQL injection vulnerability affects the Motors WordPress plugin by StylemixThemes, versions 1.4.109 and earlier. The flaw is reachable over the network without any authentication or user interaction, making it exploitable by any external attacker who can reach the WordPress site. Successful exploitation enables blind SQL injection, giving an attacker read access to the underlying database contents and limited ability to disrupt service availability. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress site via standard HTTP/HTTPS to exploit this flaw.

• AuthenticationNot required

  No account or credentials are needed; the injection point is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker sends crafted requests directly to the server and does not need any user to click a link or take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or environmental factors to trigger.

Blast Radius

• An attacker can extract the full contents of the WordPress database using blind SQL injection techniques, including user credentials, password hashes, email addresses, and any stored customer or transactional records.
• Database confidentiality is fully compromised: all rows and columns accessible to the database user running WordPress are readable by the attacker.
• The vulnerability carries a low availability impact, meaning the attacker can cause limited, intermittent disruption to the database or the WordPress site through malformed queries.
• The scope token is Changed (S:C), indicating the impact can extend beyond the WordPress application itself to other components sharing the same database server.