External risk intelligence

Automotive Listings Blind SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-67928

This vulnerability affects a WordPress plugin designed to manage automotive listings. Such plugins are typically deployed on public-facing websites to allow users to view and search inventory, making the web interface directly accessible from the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A SQL injection vulnerability has been identified in the Automotive Listings theme, specifically impacting versions up to and including 18.6. This flaw allows attackers to potentially access or manipulate sensitive data by crafting malicious SQL queries, which could have implications for the integrity and confidentiality of stored information.

Attackers can inject malicious SQL commands.
Leadership should remember this affects public-facing websites.
Confirm relevance and assess potential data exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a website using the affected automotive listings theme. This could lead to unauthorized access to or manipulation of the website's database.

Accessible via the internet
SQL query input
Database compromise risk

Live Threat

Current exploitation, exposure, and threat context

A SQL Injection vulnerability in the Automotive Listings plugin could allow an unauthenticated attacker to perform blind SQL injection. This could occur when the plugin processes specially crafted input that is not properly neutralized, potentially leading to unauthorized access to or manipulation of the underlying database when supported by the advisory.

Database contents could be exposed.
Via specially crafted network input.
Unauthorized data access or alteration.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the Automotive Listings theme affects public-facing websites, making it a priority for teams managing web applications and their underlying infrastructure. The initial step is to identify all instances of the affected theme, confirm their exposure and business criticality, and then assign ownership to the appropriate team for risk-based remediation planning.

Web application and platform teams own remediation.
Verify external exposure and business criticality.
Plan maintenance for coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Automotive Listings plugin?

Automotive Listings is a WordPress plugin used by car dealerships and automotive businesses to display, organize, and manage vehicle inventory on their websites. It provides the front-end interface where site visitors browse car listings and search through available stock, making it a functional component of a site's public-facing digital showroom.

What does CVE-2025-67928 mean in plain English?

This is a SQL Injection vulnerability (CWE-89). It means the plugin fails to properly filter user input before using it in database queries. Because it is a 'Blind' SQL injection, an attacker cannot immediately see the database output, but they can systematically ask the database true-or-false questions to slowly extract sensitive information or alter data.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending specially crafted network requests to the website that the plugin then processes. This vulnerability is not triggered by standard site navigation or legitimate user searches; it requires an attacker to deliberately inject malicious SQL syntax into input fields that the plugin fails to neutralize.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this plugin is typically deployed on public-facing websites to enable inventory searches. Because these interfaces are designed to be accessible from the internet, any instance running a vulnerable version is inherently exposed to external network requests, making it a higher priority for review.

What should I do if I run this technology?

Start by identifying every WordPress site in your environment that has the Automotive Listings theme installed. Verify the specific version in use; if it is 18.6 or older, confirm the site's business criticality and exposure. Once identified, assign the asset to the appropriate technical team to plan for updates and maintenance.

References

patchstack.com/database/Wordpress/Plugin/automotive/vulnerability/wo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.