Motors WordPress Plugin CVE-2026-39515

Exploitation requires an authenticated WordPress subscriber account on the target site. The subscriber role is the lowest default WordPress role and is freely obtainable through self-registration on sites with open registration enabled (WordPress default). The target site must be running the Motors plugin in a version prior to 1.4.107. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is remotely executable with low complexity and requires no user interaction beyond possessing subscriber-level access. Exploitation is limited by the authentication requirement: WordPress sites that disable user self-registration or restrict subscriber account creation significantly reduce exposure. The impact scope is further bounded to availability only (C:N/I:N) - data theft or persistent code execution are not supported by available evidence. Non-default configurations or specific plugin features may further gate the vulnerable code path, but the exact triggering condition is not disclosed in public advisories.

The NVD-assigned CVSS base score of 6.5 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring low-privilege authentication (PR:L), with no user interaction (UI:N), unchanged scope (S:U), and high availability impact (A:H) but no confidentiality (C:N) or integrity (I:N) impact. The PR:L metric is the primary practical constraint: exploitation requires a valid subscriber-level account, raising the exploitation bar relative to unauthenticated vulnerabilities. No EPSS score was included in the source intelligence, so quantified exploitation probability cannot be stated. KEV status is not confirmed - this CVE does not appear in the CISA KEV catalog based on available data. No public exploit code has been identified. The availability-only impact profile (C:N/I:N) means this cannot be leveraged for data exfiltration or code execution as assessed from current data - risk is primarily service disruption. For WordPress sites with open user registration, real-world risk is meaningfully elevated because an attacker can self-provision the required subscriber account at no cost.

An attacker registers a free subscriber account on a WordPress site running the Motors plugin prior to 1.4.107 - trivially possible on sites with open registration. Authenticated as a subscriber, the attacker sends crafted HTTP requests to the vulnerable plugin endpoint, bypassing absent authorization checks to invoke a high-availability-impact action repeatedly, disrupting the site's availability for legitimate users. No public exploit code has been identified at time of analysis.