Motors WordPress Plugin CVE-2025-10494

Requires an authenticated account at Subscriber level or higher on a WordPress site running the Motors plugin version 1.4.89 or earlier; the attacker invokes the plugin's profile-picture deletion feature, which fails to properly validate the supplied file path, allowing deletion of arbitrary server files (e.g., wp-config.php). Primary limiting factor is the authentication requirement (PR:L) - exploitation is trivial where open user registration is enabled (the WordPress default allows Subscriber signups when 'Anyone can register' is on) but requires obtaining a low-privilege account otherwise. No user interaction by a victim and no non-default configuration beyond having the vulnerable plugin active are needed.

This is a credible, actionable priority for sites running the affected plugin, though not a mass-exploitation emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates a remotely reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction - consistent with the description's 'Subscriber-level access and above', a bar trivially met on any site allowing user registration. The high integrity and availability impact (I:H/A:H) is justified: arbitrary file deletion of wp-config.php can force WordPress into setup mode and pivot to full remote code execution (reflected in the 'RCE' tag). Countervailing signals temper the urgency: EPSS is only 0.49% (40th percentile), there is no CISA KEV listing, and no public exploit was supplied, so there is no evidence of active or automated exploitation yet. No SSVC decision data was provided. The signals are internally consistent - a genuinely high-CVSS flaw whose real-world exploitation currently appears latent rather than widespread, gated by the need for an authenticated account on a vulnerable, registration-open site.

An attacker self-registers (or uses any existing low-privilege account) to obtain Subscriber access on a WordPress site running Motors ≤1.4.89, then abuses the profile-picture deletion function, supplying a traversal/manipulated path to delete wp-config.php. With the site thrown into an uninitialized state, the attacker re-runs setup pointing at an attacker-controlled database to achieve remote code execution. No public exploit code was identified at time of analysis.