CVE-2026-6674

The CMS für Motorrad Werkstätten WordPress plugin versions up to 1.0.0 contains a SQL Injection vulnerability in the 'arttype' parameter caused by insufficient input escaping and inadequate SQL query preparation. This flaw allows authenticated attackers with subscriber-level or higher privileges to inject malicious SQL commands and extract sensitive database information. The vulnerability has a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials, but no user interaction. The primary impact is confidentiality compromise through unauthorized data access, with no integrity or availability concerns. The EPSS score of 0.00027 indicates minimal current exploit probability, placing this threat below the 0.08th percentile of all CVEs. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists, suggesting no widespread active exploitation at this time. Community attention appears limited, and there are no known public exploits readily available, indicating this represents a lower-priority remediation concern compared to critical vulnerabilities with active exploitation evidence.