StylemixThemes Motors CVE-2026-104399

Affects StylemixThemes Motors (car dealership/classified listings WordPress plugin) in all versions from an unspecified lower bound through 1.4.124. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special configuration are required - exploitation works against network-reachable default installations of the plugin. The primary limiting factors are that the target site must run the vulnerable Motors plugin at version ≤1.4.124 and that impact is confined to disclosure of low-sensitivity embedded data (no write access or service disruption); the description does not name a specific feature or non-default setting as a precondition.

This is a moderate-severity information disclosure flaw (CVSS 4.0 base 6.9, vendor-rated by Patchstack) in the StylemixThemes Motors WordPress plugin. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability requiring no user interaction, which raises its real-world accessibility. However, impact is deliberately narrow: only VC:L (low confidentiality) with no integrity (VI:N) or availability (VA:N) effect, consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data) - the flaw leaks embedded sensitive data rather than enabling takeover. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; this reads as a lower-priority, patch-in-normal-cycle issue rather than an emergency, despite the unauthenticated network vector. The signals are internally consistent (unauthenticated + network + low-confidentiality-only), with no contradictions to flag, though the description is terse and does not specify exactly what sensitive data is exposed - verify scope with the Patchstack advisory.

A remote, unauthenticated attacker interacts with a vulnerable Motors plugin endpoint or page over the network and receives a response that embeds sensitive information not intended for disclosure. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, retrieval is straightforward, but the impact is limited to reading low-sensitivity data (VC:L). No public exploit identified at time of analysis.