Motors Car Dealership Plugin CVE-2026-1934

Exploitation requires three specific conditions: (1) the WordPress site must have user registration enabled and the attacker must have obtained a Subscriber-level or higher account (even free registration accounts qualify), (2) the Subscriber must be able to access the WordPress user profile edit page (personal_options_update action), which is the default behavior for all authenticated users, and (3) the vulnerable version of the Motors plugin (1.4.103 or earlier) must be active on the site. The stm_save_user_extra_fields() function hooks directly into personal_options_update, making exploitation a single HTTP POST request to the standard WordPress profile page. No special configuration is required-the vulnerability exists in default installations. Exploitation is limited to modifying user meta fields of the authenticated user's own account; privilege escalation to administrator is not possible via this vector. Sites with user registration disabled are not vulnerable, but most e-commerce and membership sites enable registration to allow customers to create accounts.

CVSS 4.3 with AV:N/AC:L/PR:L reflects moderate attack complexity and local privileges required, limiting exploitability to authenticated users. However, the real-world impact is significant: this converts a payment system from protected to bypassable by the attacker population (any site user). The low CVSS score undersells the integrity risk because CVSS weights confidentiality and availability equally with integrity, and this CVE has zero confidentiality or availability impact-it is purely an integrity bypass. EPSS data is not provided, so exploitation probability cannot be cross-referenced. No KEV status or POC availability is confirmed in the input, meaning this is not yet in the active exploitation database. The attack requires only network access and a valid WordPress account (Subscriber level), both of which are common on many WordPress sites with user registration enabled. For any e-commerce or membership site using this plugin, the financial impact of unaudited Dealer membership access is direct and measurable, making this a high-priority fix despite the moderate CVSS score. The fix is confirmed available (WordPress plugin repo shows changeset 3468174 in trunk and version 1.4.104 tags), so patch availability is not a limiter.

An attacker with a Subscriber account (commonly obtained via free registration on WordPress sites) logs into their user profile page, crafts a POST request to the profile update endpoint with stm_payment_status set to 'completed' in the POST data, and submits it. The vulnerable stm_save_user_extra_fields() function accepts the POST data, checks only that the user can edit their own profile (which passes for Subscriber level), and updates the user meta without validating that Subscriber users should never control payment status. The attacker's account is instantly flagged as having completed payment and gains access to paid Dealer membership features, including the ability to list vehicles for sale, without paying any fee or completing a PayPal transaction.