The vulnerability resides in the Motors – Car Dealership & Classified Listings Plugin for WordPress and allows attackers to perform a time‑based blind SQL injection through the 'stm_lat' and 'stm_lng' parameters in all releases up to 1.4.109. Unsanitized user input is directly incorporated into an existing SQL query, enabling unauthenticated users to append arbitrary SQL statements and extract sensitive information from the database. The flaw is a classic example of CWE‑89, where incorrect handling of SQL input leads to injection potential.

The affected product is the Cars and Classified Listings Plugin from stylemix, known as the Motors plugin for WordPress. Any installation using version 1.4.109 or earlier is vulnerable; the issue was addressed in version 1.4.110 and later. No other vendors or products are listed.

With a CVSS score of 7.5, the vulnerability is classified as high severity. The EPSS score is not available, but the lack of authentication and the presence of a direct SQL entry point make exploitation relatively straightforward for an attacker. Because the plugin is publicly accessible on WordPress sites, the risk of exploitation is real. The vulnerability is not yet listed in the CISA KEV catalog, but it could be actively exploited given the high impact and ease of attack via standard web traffic.