CVE-2026-6806 in The Motors Plugin
Summary
by MITRE • 09/30/2026
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The Motors – Car Dealership & Classified Listings Plugin, a widely utilized WordPress extension designed to facilitate vehicle sales and classified advertisements, contains a critical security flaw identified as time-based blind SQL injection. This vulnerability affects all versions up to and including 1.4.109. The root cause lies in the insufficient sanitization of user-supplied input within the stm_lat and stm_lng parameters, which are typically used for geolocation data such as latitude and longitude coordinates on map interfaces or search filters. Because these inputs are not adequately escaped nor prepared before being incorporated into database queries, an attacker can manipulate them to alter the structure of SQL statements executed by the application backend.
From a technical perspective, this flaw represents a classic instance of CWE-89 Improper Neutralization of Special Elements used in an SQL Command. The vulnerability allows unauthenticated attackers to inject malicious SQL code that exploits time-based blind techniques. In such attacks, the attacker does not receive direct feedback from the database regarding the success or failure of injected queries. Instead, they infer information by observing variations in response times caused by conditional logic within the injected payload. This method enables the extraction of sensitive data character by character without triggering obvious error messages that might alert administrators to the breach.
The operational impact of this vulnerability is severe due to its unauthenticated nature. Attackers do not need valid credentials or any form of user interaction beyond accessing specific endpoints exposed by the plugin, such as map views or search results pages. By leveraging time-based blind SQL injection, an adversary can potentially extract sensitive information from the WordPress database. This may include administrative usernames and password hashes, which could lead to full account compromise. Furthermore, attackers might access proprietary business data stored within classified listings, customer contact details, or other confidential records housed in the same database schema as the application credentials.
This vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter under certain execution contexts if further exploitation leads to remote code execution, but primarily it falls under Data Exfiltration techniques such as T1078 Valid Accounts or indirect data theft via SQL injection patterns often categorized under reconnaissance or credential access phases depending on the ultimate goal. The lack of input validation allows for unauthorized database interaction that bypasses standard authentication mechanisms entirely.
To mitigate this risk, immediate action is required to update the Motors plugin to version 1.4.110 or later where these parameters are properly sanitized and prepared using parameterized queries. Until an update is applied, administrators should consider restricting access to affected endpoints via web application firewall rules that detect SQL injection patterns in latitude and longitude parameters. Additionally implementing strict input validation on client-side scripts can provide a secondary layer of defense by preventing malformed data from reaching the server logic. Regular security audits and code reviews focusing on database interaction layers are essential to prevent similar vulnerabilities arising from improper handling of user-supplied geolocation or search inputs in WordPress ecosystems.