What is the CVSS score of CVE-2026-66693?

CVE-2026-66693 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Motors Plugin CVE-2026-66693

EUVD-2026-57903 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-r3c2-5pcc-7qp9

WordPress Authentication Bypass Wordpress Plugin Motors Stylemix

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

PR:L confirmed by subscriber-level requirement; AV:N and AC:L reflect network exploitability with no special conditions; I:H reflects unauthorized privileged writes; C and A are N per described impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:11 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Motors <= 1.4.113 versions.

AnalysisAI

Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through version 1.4.113 allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher roles, resulting in a high integrity impact. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected component is the Motors WordPress plugin by Stylemix (CPE: cpe:2.3:a:stylemix:motors:*:*:*:*:*:*:*:*), a plugin targeting car dealership and classified listing sites. The root cause is CWE-862 (Missing Authorization): one or more AJAX handlers, REST API endpoints, or form-processing routines in the plugin fail to enforce a capability check before executing privileged operations. WordPress's permission model uses subscriber as the lowest authenticated role; a properly implemented plugin must verify nonces and capabilities (e.g., edit_posts, manage_options) server-side. When these checks are absent or bypassable, a subscriber can trigger actions intended for editors, administrators, or shop managers. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N confirms network exploitability with only low privileges, no user interaction, and a high integrity impact confined to the vulnerable system.

RemediationAI

No exact fix version is specified in the available intelligence data - the Patchstack advisory should be consulted directly for the patched release version. Site administrators should update the Motors plugin to the latest version available in the WordPress plugin repository as the primary remediation step. If an immediate update is not possible, the most effective compensating control is to disable user self-registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber accounts; note this will block legitimate new user sign-ups. Alternatively, audit and restrict existing subscriber accounts to a minimum. Site owners using managed WAF solutions (e.g., Wordfence, Patchstack Firewall) should enable the virtual patch rule associated with this CVE if provided by the vendor. Refer to the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-113-broken-access-control-vulnerability for the confirmed fixed version once published.