WordPress Motors plugin versions up to 1.4.126 contain an SQL injection flaw that allows attackers to inject malicious SQL commands into queries executed against the database. The vulnerability uses blind exploitation techniques, meaning attackers can infer database information through timing or error responses without directly returning data. If successfully exploited, an attacker can read confidential data, modify or delete records, potentially create new privileged users, and in some workflows gain further elevation of privileges.

The flaw affects any WordPress installation that has the StylemixThemes Motors plugin installed with a version up through 1.4.126. The plugin’s database integration interfaces are the primary attack surfaces.

The CVSS score of 9.3 classifies this as a critical issue, and while an EPSS score is not available, the absence of such data does not lower the likelihood that attackers will target this known vulnerability. The plugin’s endpoints are visible to anyone who can reach the WordPress site, suggesting that the attack vector is remote via the web interface. No authentication or privilege is required to send the malicious payload, so any user with access to the site’s front‑end or back‑end can potentially exploit the flaw. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating that publicly available exploits have not yet been observed, but the critical CVSS score and the blind nature of the injection urge caution.