What is the CVSS score of CVE-2026-54814?

CVE-2026-54814 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Motors WordPress Plugin are affected by CVE-2026-54814?

The StylemixThemes Motors WordPress plugin (≤v1.4.109) contains a remotely exploitable file inclusion flaw enabling attackers to access website source code, application secrets, and potentially…

How to fix or mitigate CVE-2026-54814?

24 hours: Scan all WordPress instances for StylemixThemes Motors plugin version 1.4.109 or earlier; immediately deactivate or uninstall the plugin; review recent logs for suspicious file inclusion patterns. 7 days: If plugin removal is not feasible, deploy Web Application Firewall (WAF) rules blocking path traversal sequences (../, ..\ ) and PHP file inclusion patterns; restrict PHP execution permissions in upload and cache directories. 30 days: Monitor vendor announcements for patch release; evaluate and implement alternative plugins with equivalent functionality; conduct incident review for exploitation evidence.

Motors WordPress Plugin CVE-2026-54814

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Motors WordPress Wordpress Plugin

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable LFI with no auth or UI but non-trivial preconditions (AC:H); high confidentiality from arbitrary file read, integrity/availability only low since RCE requires an additional log/session-poisoning step.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:25 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion.

This issue affects Motors: from n/a through 1.4.109.

AnalysisAI

Local file inclusion in StylemixThemes Motors WordPress plugin versions up to and including 1.4.109 allows remote attackers to include arbitrary PHP files from the server filesystem. The flaw is classified as CWE-98 (PHP Remote File Inclusion) but is exploitable only as LFI per the vendor description, enabling source code disclosure, sensitive file read, and potential code execution if a writable PHP file can be reached. No public exploit identified at time of analysis and the vulnerability is not present in CISA KEV.

Technical ContextAI

The Motors plugin (cpe:2.3:a:stylemixthemes:motors) is a commercial WordPress theme/plugin used for car dealership and classified listings sites. CWE-98 covers improper control of filename in PHP include/require statements, where user-controlled input flows into include(), require(), include_once(), or require_once() without proper validation against an allowlist or canonicalization. Although the CWE name references Remote File Inclusion, modern PHP installations typically disable allow_url_include, so the practical impact here is Local File Inclusion - the parameter likely reaches an include() call that resolves to a path on disk, enabling traversal or absolute-path reads of any PHP-readable file (wp-config.php, /etc/passwd, session files, log files for LFI-to-RCE).

RemediationAI

Upgrade to the next release after 1.4.109 as published by StylemixThemes; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-109-local-file-inclusion-vulnerability should be consulted for the exact fixed version, which is not stated in the input data (Patch available per vendor advisory; exact fix version not confirmed from available data). Until the patched build is deployed, restrict access to the plugin's vulnerable endpoints with a WAF rule blocking requests containing path-traversal sequences (../, ..%2f, null bytes, php:// wrappers) targeting Motors plugin paths under /wp-content/plugins/motors-car-dealership-classified-listings/ - note this can break legitimate plugin functionality and should be tuned per site. Additionally set PHP open_basedir to constrain include() to the WordPress install path (trade-off: may interfere with other plugins), disable allow_url_include and allow_url_fopen in php.ini, and enforce least-privilege on the PHP-FPM user so it cannot read wp-config.php from a sibling site or /etc secrets it does not need.