CVE-2026-115964

Summary

Blind SQL injection in StylemixThemes Motors plugin allows attackers to infer database contents by sending crafted SQL payloads and observing response timing or content differences, potentially exposing sensitive data.

Exploitability

Exploitation requires no authentication or user interaction and is straightforward for an attacker with network access to the affected endpoint.

Blast radius

Successful exploitation could lead to full compromise of backend database confidentiality via data extraction, while availability is moderately impacted due to time-based blind techniques.

Detection

Defenders may observe delayed HTTP responses correlated with specific SQL injection payloads (e.g., SLEEP(), BENCHMARK(), or long-running queries) in web server access logs; however, no reliable host-based or network-based indicator is derivable from the published description.

Prioritized remediation

Upgrade to Motors version 1.4.127 or later, as this version contains the vendor's fix for the reported Blind SQL Injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.