Motors WordPress Plugin CVE-2026-54814

The target WordPress site must have the StylemixThemes Motors plugin installed at version 1.4.109 or earlier and the vulnerable endpoint must be network-reachable. CVSS PR:N/UI:N indicates no authentication or victim interaction is required, but AC:H means exploitation is not push-button - the attacker likely needs to satisfy a specific request shape, parameter combination, or environmental state (for example, a particular plugin sub-feature being enabled or a request originating against a specific listing/template path). The vendor description does not name the affected parameter or endpoint, so until Patchstack publishes details the practical exploitation barrier is recon effort. Successful pivot to code execution further requires either allow_url_include=On (rare on modern PHP, lifting it to true RFI) or a writable PHP-includable artifact such as a log or session file.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 (High) and reports no authentication required, but AC:H signals non-trivial exploitation prerequisites such as a specific request shape or environmental conditions. The Patchstack description does not specify which parameter or endpoint is vulnerable, which materially limits attacker reconnaissance until a public PoC or patch diff is published. EPSS and KEV data are not provided in the input, and no public exploit identified at time of analysis. Given Motors is a paid commercial WordPress plugin with a smaller install base than free plugins, opportunistic mass exploitation is less likely than targeted attacks against known dealership sites; however the I:H/A:H ratings (which exceed typical pure-LFI scoring) hint the vendor expects LFI-to-RCE chains via WordPress log/session poisoning.

A remote unauthenticated attacker identifies a WordPress site running the Motors plugin (via /wp-content/plugins/motors-car-dealership-classified-listings/ fingerprints) and crafts a request to the vulnerable parameter passing a traversal payload to read wp-config.php, exfiltrating database credentials and WordPress auth keys. With salts in hand, the attacker forges authentication cookies or pivots to the database to create an administrator account; if the LFI can target a writable log file or session store, the chain escalates to PHP code execution under the web user.