What is the CVSS score of CVE-2026-1934?

CVE-2026-1934 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Motors Car Dealership Plugin CVE-2026-1934

EUVD-2026-29422 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 Wordfence

GHSA-3fxq-3j9r-3r3q

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 10:06 vuln.today

CVE Published

May 12, 2026 - 08:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The Motors - Car Dealership & Classified Listings plugin for WordPress is vulnerable to Payment Bypass via insecure user meta update in all versions up to, and including, 1.4.103 This is due to the stm_save_user_extra_fields() function updating sensitive user meta fields from POST data without verifying that the current user should have permission to modify those fields. The function hooks into the 'personal_options_update' action and only checks current_user_can('edit_user', $user_id), which passes for any user editing their own profile. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set their stm_payment_status to 'completed', bypassing the PayPal payment verification and gaining access to paid Dealer membership features without completing any transaction.

AnalysisAI

Authenticated users with Subscriber-level access can bypass PayPal payment verification in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to 1.4.103) by directly modifying their stm_payment_status user meta field to 'completed', gaining access to paid Dealer membership features without completing any transaction. The vulnerability exists in the stm_save_user_extra_fields() function, which fails to validate permission for sensitive meta field modifications during profile updates. While CVSS 4.3 reflects low severity, the integrity impact is direct-payment systems are completely circumvented for any authenticated user.

Technical ContextAI

The Motors plugin hooks into WordPress's 'personal_options_update' action to handle user profile updates via the stm_save_user_extra_fields() function. This function accepts POST data containing user meta fields and updates them using update_user_meta() with only a basic current_user_can('edit_user', $user_id) check. In WordPress, this capability passes for any user editing their own profile, including Subscriber-level accounts. The function does not implement field-level authorization-it blindly trusts that POST data for sensitive fields like stm_payment_status should only come from administrative sources. The vulnerability is rooted in CWE-862 (Missing Authorization), where the authorization check exists at the function level but lacks granular control over which user meta fields authenticated users may modify. The CPE cpe:2.3:a:stylemix:motors_-_car_dealership_&_classified_listings_plugin:*:*:*:*:*:*:*:* identifies the vulnerable plugin across all versions through 1.4.103.

RemediationAI

Update the Motors plugin to version 1.4.104 or later immediately. The fix is confirmed in WordPress plugin repository changeset 3468174 (https://plugins.trac.wordpress.org/changeset/3468174/motors-car-dealership-classified-listings/trunk/includes/user-extra.php), which implements field-level authorization checks to prevent authenticated users from modifying sensitive meta fields like stm_payment_status. Administrators should verify that the update is applied via WordPress Admin Dashboard > Plugins > Installed Plugins, and confirm the version number is 1.4.104+. For sites unable to update immediately, a compensating control is to restrict user registration to administrators only or to prevent Subscriber-level users from accessing the user profile page where the POST request is generated; however, this may limit legitimate site functionality. Another temporary mitigation is to disable the personal profile edit capability for non-administrator roles using a WordPress role/capability plugin, but this should only be a bridge until patching is completed, as it may break user workflows.