Motors Theme CVE-2026-27433

Exploitation requires no authentication (PR:N per CVSS vector) and no user interaction (UI:N). The target WordPress site must have the Motors theme actively installed and set as the active theme at version 5.6.80 or earlier. The specific theme feature, AJAX action name, or endpoint with the missing authorization check is not disclosed in available data - Patchstack's full advisory may contain additional detail. Factors limiting exploitation: the theme is niche (automotive sector), reducing the total population of exposed hosts; scope is unchanged (S:U), so exploitation cannot pivot to affect other WordPress installations or the underlying server via this flaw alone; and the maximum impact per the CVSS vector is limited to partial integrity modification and partial availability disruption with no confidentiality exposure.

The NVD-assigned CVSS 3.1 score of 6.5 (Medium) reflects a meaningful but bounded threat: the attack is fully remote, requires zero privileges, and has low complexity, but impact is capped at integrity:Low and availability:Low with no confidentiality breach (C:N). This means the attacker cannot exfiltrate data but can modify site content or disrupt specific functionality. The scope is unchanged (S:U), limiting blast radius to the vulnerable component itself. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and no reported POC reduces urgency compared to a KEV-listed flaw with equivalent CVSS. However, the PR:N/AC:L combination means exploitation requires no skill barrier - automated WordPress scanners routinely probe for exactly this class of vulnerability. Sites running the Motors theme without a WAF or rate limiting are at realistic risk from opportunistic mass scanning. The automotive-niche deployment base constrains total exposed population but does not eliminate risk for those running the theme.

An unauthenticated attacker identifies a WordPress site running the Motors theme via passive fingerprinting (e.g., theme name in page source or HTTP headers) and sends a crafted HTTP POST request to the WordPress AJAX endpoint targeting the vulnerable handler. The missing authorization check allows the request to proceed, enabling the attacker to modify theme data or trigger a denial-of-service condition on specific theme functionality without supplying any credentials. No public POC has been identified at time of analysis, but the low complexity of the attack class means any attacker familiar with WordPress broken access control patterns could develop an exploit independently.