Motors WordPress Plugin CVE-2026-91023

Exploitation requires an authenticated WordPress account with subscriber-level privileges or above (PR:L), AND the target site must have WooCommerce active AND the Motors plugin's paid featured-listing option enabled - the vendor explicitly states neither is a default configuration, which is why attack complexity is High. No user interaction is needed (UI:N). The impact is limited to setting metadata on posts the attacker does not own, including overwriting product prices (integrity-only). These non-default dependencies sharply narrow the real-world exploitable population to Motors sites monetizing featured listings via WooCommerce; default or non-WooCommerce installations are not exploitable.

This is a genuinely low-priority issue despite being a missing-authorization flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, base 3.1) reflects that exploitation is network-reachable but gated behind high attack complexity and requires an authenticated subscriber-level account, with only limited integrity impact and no confidentiality or availability impact. No EPSS score, KEV listing, or public POC was provided in the intelligence - exploitation status is therefore 'no public exploit identified at time of analysis,' and there is no evidence of active or widespread exploitation. The AC:H rating is well justified: the vendor explicitly states exploitation requires both WooCommerce to be active and the plugin's paid featured-listing option to be enabled, 'neither of which is a default configuration.' All signals are internally consistent - there is no conflict between CVSS, description, and the (absent) exploitation telemetry. The one metadata concern is the 'Authentication Bypass' tag, which conflicts with CWE-862 (Missing Authorization) and the fact that attackers must already be authenticated; this is a broken-access-control/authorization issue, not an authentication bypass. Net: a real but low-severity bug that matters only to the subset of Motors sites running the paid WooCommerce featured-listing workflow.

On a Motors-based site that sells featured car listings through WooCommerce, an attacker registers a free subscriber account, then invokes a listing-management action while supplying the ID of a listing they do not own. Because the plugin fails to verify ownership (CWE-862), the attacker overwrites metadata on that post - most impactfully the product price, e.g. dropping a paid featured listing's price to zero. No public exploit code was identified at time of analysis, and the attack is only possible against the non-default WooCommerce paid-featured-listing configuration.