EUVD-2026-38665
GHSA-w9jx-q9hr-x62p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered CSRF requires no attacker privileges but mandates active admin user interaction; integrity impact limited to plugin configuration fields only, no confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the motordesk_admin_home function. This makes it possible for unauthenticated attackers to update the plugin's configuration settings, including the search page URI and custom template directory path via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the MotorDesk WordPress plugin (all versions ≤ 1.1.2) allows unauthenticated remote attackers to overwrite critical plugin configuration settings by tricking a logged-in administrator into clicking a crafted link. The vulnerable function motordesk_admin_home in motordesk_admin.php lacks proper WordPress nonce validation, meaning the server accepts state-changing POST requests without confirming the administrator intentionally submitted them. No public exploit code has been identified at time of analysis; the CVSS 4.3 Medium score accurately reflects the social-engineering dependency, though the custom template directory path setting warrants secondary scrutiny for potential path traversal chaining.
Technical ContextAI
MotorDesk is a WordPress plugin designed for automotive dealership management, identified by CPE cpe:2.3:a:motordesk:motordesk:*:*:*:*:*:*:*:*. WordPress's standard CSRF defense requires that administrative form handlers verify a nonce - a one-time cryptographic token bound to the user's session - before processing any state-changing request. The vulnerability, rooted in CWE-352 (Cross-Site Request Forgery), exists because the motordesk_admin_home function in include/motordesk_admin.php (at code lines L122, L134, L157, and L182 per the WordPress plugin Trac repository) either omits this nonce check entirely or validates it incorrectly. Without nonce enforcement, a browser with an active admin session will happily submit a forged form to the plugin's admin endpoint, allowing an attacker-controlled page to silently alter plugin configuration - specifically the search page URI and the custom template directory path.
RemediationAI
No vendor-released patched version has been independently confirmed in the available data - administrators should monitor the MotorDesk plugin page on the WordPress plugin repository and the Wordfence advisory for a patched release and upgrade as soon as one is published. As an immediate compensating control, administrators should deactivate the MotorDesk plugin if it is non-essential to current operations, which eliminates the attack surface with no side effects beyond loss of plugin functionality. If the plugin must remain active, deploy Wordfence or an equivalent WAF with CSRF detection rules to intercept forged form submissions targeting the WordPress admin area; note that WAF-based mitigations may produce false positives on legitimate admin actions if rules are overly broad. All site administrators should be advised to avoid clicking unsolicited links while authenticated to the WordPress dashboard. The vulnerable code references are available for manual patching review at https://plugins.trac.wordpress.org/browser/motordesk/trunk/include/motordesk_admin.php#L122, L134, L157, and L182.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today