The vulnerability is an improper neutralization of special elements used in an SQL command, allowing blind SQL injection. This flaw enables an attacker to inject crafted SQL commands through the plugin’s exposed interfaces, potentially reading or altering data stored in the WordPress database, which could lead to data compromise.

The StylemixThemes Motors plugin, used in WordPress sites, is affected from the initial release up through version 1.4.109. The issue does not affect newer releases such as 1.4.110 and later.

The CVSS score of 9.3 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can send crafted input to the plugin’s exposed interfaces to perform blind SQL queries that can read or modify data stored in the WordPress database, potentially leading to data compromise. The impact scope is limited to the affected WordPress site and its underlying database.