CVE-2026-6674 is an SQL Injection vulnerability in the WordPress plugin 'CMS für Motorrad Werkstätten' by tholstkabelbwde. The issue exists in the 'arttype' parameter due to improper neutralization of special elements in SQL commands, allowing authenticated users with subscriber-level privileges or higher to inject additional SQL queries. This vulnerability affects all versions up to and including 1.0.0. The flaw is caused by insufficient escaping of user input and lack of prepared statements in the SQL query construction. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, and partial privileges required, with high confidentiality impact but no integrity or availability impact. No patch or official remediation has been published by the vendor, and no known exploits have been reported.

Successful exploitation allows an authenticated user with subscriber-level access or higher to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact data integrity or availability but poses a confidentiality risk. There are no known exploits in the wild, and the attack requires at least low-privileged authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the 'arttype' parameter. Avoid granting unnecessary privileges to users and consider disabling or replacing the vulnerable plugin if feasible.