Motors WordPress Theme CVE-2026-93950

The target must be a WordPress site running the StylemixThemes Motors theme at a version from the earliest affected release through 1.4.108. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required - an unauthenticated remote attacker can reach the vulnerable functionality over the network against a default installation. The primary limiting factors are that the Motors theme must be installed and active, and that the site must not yet be updated past 1.4.108; impact is confined to integrity (C:N/A:N), so the flaw enables unauthorized data modification or privileged actions rather than data disclosure or denial of service.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high integrity impact and no confidentiality or availability impact (C:N/I:H/A:N), yielding a base score of 7.5 - consistent with a CWE-862 Missing Authorization issue that lets unauthenticated actors invoke privileged actions or modify data they should not. However, several real-world exploitation signals are MISSING from the input: there is no EPSS probability, no CISA KEV listing, and no indication of public POC code, so exploitation status must be treated as 'no public exploit identified at time of analysis.' This tempers the raw score - a 7.5 unauthenticated broken-access-control flaw in a popular WordPress theme is the kind of bug that is frequently automated once a POC appears, but absent EPSS/KEV/POC data there is no evidence of current mass exploitation. The description is also vague ('allows Exploiting Incorrectly Configured Access Control Security Levels') and does not name the specific endpoint or action affected, so the exact privileged operation an attacker gains is INFERRED, not confirmed. Net: a genuine high-priority patching item for Motors operators given unauthenticated network reachability, but current active-exploitation risk is unconfirmed rather than demonstrated.

A remote, unauthenticated attacker sends a crafted HTTP request to a Motors-powered WordPress site invoking a theme function that fails to verify the caller's authorization, allowing them to alter data or perform an action reserved for privileged users (consistent with the I:H, C:N integrity-only impact). No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication make exploitation straightforward once the vulnerable endpoint is known.