EUVD-2026-38214
GHSA-6xrf-25hf-gfpv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network access (PR:N, AV:N, AC:L) with no scope change; impact confined to integrity via metadata writes, no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary post metadata, such as the gallery, featured image and, on WooCommerce sites, product prices.
AnalysisAI
Unauthenticated post metadata tampering in the Motors WordPress plugin (all versions before 1.4.110) allows any remote attacker to overwrite arbitrary post metadata - including gallery images, featured images, and, critically, WooCommerce product prices - without any credentials or CSRF token. The missing authorization and CSRF checks on an AJAX action (CWE-862) are confirmed by WPScan, who also published a proof-of-concept. The SSVC assessment flags this as automatable, meaning mass exploitation via scripted scanning is realistic, though EPSS sits at only 0.12% (2nd percentile), indicating exploitation has not yet become widespread.
Technical ContextAI
The Motors WordPress plugin (CPE: cpe:2.3:a:unknown:motors) is an automotive dealership and vehicle listing plugin that integrates with WooCommerce. The vulnerability stems from CWE-862 (Missing Authorization): the plugin registers a WordPress AJAX action accessible to unauthenticated users (typically via wp-admin/admin-ajax.php with a nopriv hook) without verifying either the requester's capability level or a CSRF nonce. WordPress post metadata is a generic key-value store; without an authorization gate, an attacker can supply arbitrary meta keys and values for any post ID. On WooCommerce-enabled sites, post metadata directly controls product pricing fields such as _price and _regular_price, converting this from a nuisance defacement vector into a potential financial fraud vector. The CPE vendor field is listed as 'unknown' in NVD, indicating attribution is still pending in that database.
RemediationAI
Update the Motors WordPress plugin to version 1.4.110 or later, which introduces proper authorization checks and CSRF nonce validation on the affected AJAX endpoint; this is the only fully effective fix. The patch is vendor-released and available via the WordPress plugin repository or the WPScan advisory at https://wpscan.com/vulnerability/3c11e490-92d8-46e1-a0ae-7c4c703ac411/. If immediate patching is not possible, a compensating control is to configure a WAF rule blocking POST requests to wp-admin/admin-ajax.php that include the specific vulnerable action parameter - this requires identifying the action name from plugin source code and introduces risk of blocking legitimate plugin functionality. WooCommerce site operators should treat this as urgent: consider temporarily disabling the Motors plugin entirely until the patch is applied, accepting the trade-off of losing plugin functionality, to prevent product price tampering that could result in fraudulent orders.
Blind SQL injection in the StylemixThemes Motors WordPress plugin (versions up to and including 1.4.109) allows remote u
Local file inclusion in StylemixThemes Motors WordPress plugin versions up to and including 1.4.109 allows remote attack
Unauthorized data modification in the Motors car dealership and classified listings plugin for WordPress (versions <= 1.
Broken access control in the Motors WordPress plugin (StylemixThemes) prior to version 1.4.107 enables subscriber-level
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through versi
Broken access control in the Motors WordPress theme (by StyleMixThemes) versions 5.6.80 and earlier allows unauthenticat
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today