What is the CVSS score of CVE-2026-54828?

CVE-2026-54828 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Motors (WordPress) are affected by CVE-2026-54828?

The Motors WordPress plugin used by automotive dealerships for classified listings and inventory management contains a vulnerability allowing remote attackers to modify critical business data without…

How to fix or mitigate CVE-2026-54828?

Within 24 hours: Audit all WordPress installations for the Motors plugin (versions 1.4.109 and earlier); immediately disable the plugin and implement WAF rules to restrict database modifications. Within 7 days: Identify and test alternative WordPress plugins or custom solutions; establish migration timeline and communicate to stakeholders. Within 30 days: Complete migration away from the vulnerable plugin and conduct post-remediation vulnerability scanning.

Motors (WordPress) CVE-2026-54828

EUVD-2026-39366 HIGH

Missing Authorization (CWE-862)

2026-06-25 Patchstack

GHSA-pgwq-7q76-fm42

WordPress Authentication Bypass Wordpress Plugin Motors Stylemixthemes

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated, network-reachable endpoint with a missing authorization check (PR:N, AV:N, AC:L) enabling unauthorized data modification (I:H) with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:18 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.

AnalysisAI

Unauthorized data modification in the Motors car dealership and classified listings plugin for WordPress (versions <= 1.4.109) lets remote unauthenticated attackers invoke privileged actions they should not reach, due to a missing authorization check (CWE-862). The CVSS 3.1 vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are required, with a high integrity impact but no confidentiality or availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Motors is a commercial WordPress plugin from StyleMix Themes used to build car dealership and classified vehicle listing sites, identified by CPE cpe:2.3:a:stylemixthemes:motors. The root cause is CWE-862 (Missing Authorization): one or more plugin handlers execute privileged operations without verifying that the requester holds the required capability or role. WordPress plugins typically gate actions behind current_user_can() and nonce checks on admin-ajax.php or REST routes; when such a gate is omitted, the handler becomes reachable by any unauthenticated visitor, which aligns with the 'Authentication Bypass / Broken Access Control' tags supplied by Patchstack.

RemediationAI

Upgrade the Motors plugin to the first release newer than 1.4.109 that contains the fix, as published on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-109-broken-access-control-vulnerability); an exact patched version number is not provided in the input and should be confirmed against the StyleMix Themes changelog before deployment. If immediate patching is not possible, place the affected plugin endpoints behind a WordPress-aware WAF or Patchstack virtual patch, and restrict access to the plugin's admin-ajax.php and REST routes used for listing management to authorized roles via server rules - noting that overly broad blocking of admin-ajax.php can break legitimate front-end functions such as listing submission or search. As a last resort, disabling the Motors plugin removes the exposure entirely at the cost of taking dealership/listing features offline.