EUVD-2026-40935
GHSA-f64c-q58q-9942
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-exploitable AJAX action; subscriber authentication required (PR:L); own-listing nonce precondition does not raise AC beyond Low given ease of listing submission; impact is integrity-only on target post data.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Motors - Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark or unmark any other user's car listing as sold by replaying a valid nonce harvested from their own listing against an arbitrary victim post ID, triggering a site-wide 'Sold' badge on the victim's listing and silently stripping its special_car featured post meta as a side effect. Exploitation requires the attacker to hold an active listing of their own (obtainable by a Subscriber via the plugin's add-listing form) in order to harvest a valid nonce for the 'stm_mark_as_sold_car' action, which can then be replayed against any other listing's post ID.
AnalysisAI
Authorization bypass in the Motors - Car Dealership & Classified Listings Plugin for WordPress allows authenticated subscriber-level users to arbitrarily mark any other user's vehicle listing as sold by replaying a harvested nonce against a victim's post ID. All plugin versions up to and including 1.4.111 are affected. An attacker exploiting this flaw can silently deface competitor or victim listings with a site-wide 'Sold' badge while also stripping the special_car featured post meta, causing business harm on dealership or classifieds sites. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is rooted in CWE-862 (Missing Authorization) within the WordPress plugin developed by StyleMix Themes (CPE: cpe:2.3:a:stylemix:motors_-_car_dealership_&_classified_listings_plugin:*:*:*:*:*:*:*:*). WordPress nonces are cryptographic tokens intended to validate action authenticity and CSRF protection, but they do not inherently enforce object-level ownership. The plugin's stm_mark_as_sold_car AJAX action, implemented in vehicle_functions.php at lines 2400 and 2402 and surfaced via the listing owner actions template at line 74, verifies that a valid nonce for the action exists but fails to confirm that the requesting user owns the post ID being operated upon. This allows a subscriber who legitimately possesses a nonce tied to their own listing to replay it against an arbitrary post_id parameter belonging to another user's listing, as the server-side handler performs no ownership or capability check against the target post.
RemediationAI
Update the Motors plugin to a version beyond 1.4.111 as soon as a patched release is published to the WordPress plugin repository. An upstream fix has been committed (changeset 3577332 in the WordPress SVN repository at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3577332%40motors-car-dealership-classified-listings&new=3577332%40motors-car-dealership-classified-listings), however a specific released patched version number is not independently confirmed from the available input data - verify the current plugin version in the WordPress.org repository before updating. As a compensating control while awaiting the patch, site administrators can disable public user registration and the plugin's add-listing form for subscriber-level users, which removes the attacker's ability to harvest a valid nonce in the first place; note this trade-off eliminates the user-submitted listings feature entirely. Alternatively, restricting listing submission to higher-trust roles (Editor or above) via the plugin settings reduces subscriber-level attack surface. Monitoring AJAX requests for stm_mark_as_sold_car actions originating from users who do not own the target post ID can serve as a detection control.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today