PT-2026-103059
CVE-2026-6806
·
تاريخ النشر
2026-09-30
·
تاريخ التحديث
2026-09-30
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
The Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.110
Description
An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Attackers can append additional SQL queries to extract sensitive information from the database via the
stm lat and stm lng parameters.Recommendations
Update the plugin to a version later than 1.4.109.
As a temporary mitigation, restrict access to the parameters
stm lat and stm lng until the update is applied. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾