CVE-2026-6806

Name of the Vulnerable Software and Affected Versions The Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.110

Description An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Attackers can append additional SQL queries to extract sensitive information from the database via the stm lat and stm lng parameters.

Recommendations Update the plugin to a version later than 1.4.109. As a temporary mitigation, restrict access to the parameters stm lat and stm lng until the update is applied.