EUVD-2026-93092
GHSA-m69m-c5x3-cqgp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Motors plugin
-
ExploitSend request to vulnerable endpoint
-
ExecutionReceive response with embedded sensitive data
-
ImpactHarvest disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Affects StylemixThemes Motors (car dealership/classified listings WordPress plugin) in all versions from an unspecified lower bound through 1.4.124. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special configuration are required - exploitation works against network-reachable default installations of the plugin. The primary limiting factors are that the target site must run the vulnerable Motors plugin at version ≤1.4.124 and that impact is confined to disclosure of low-sensitivity embedded data (no write access or service disruption); the description does not name a specific feature or non-default setting as a precondition. |
| Impact | This is a moderate-severity information disclosure flaw (CVSS 4.0 base 6.9, vendor-rated by Patchstack) in the StylemixThemes Motors WordPress plugin. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability requiring no user interaction, which raises its real-world accessibility. However, impact is deliberately narrow: only VC:L (low confidentiality) with no integrity (VI:N) or availability (VA:N) effect, consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data) - the flaw leaks embedded sensitive data rather than enabling takeover. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; this reads as a lower-priority, patch-in-normal-cycle issue rather than an emergency, despite the unauthenticated network vector. The signals are internally consistent (unauthenticated + network + low-confidentiality-only), with no contradictions to flag, though the description is terse and does not specify exactly what sensitive data is exposed - verify scope with the Patchstack advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker interacts with a vulnerable Motors plugin endpoint or page over the network and receives a response that embeds sensitive information not intended for disclosure. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, retrieval is straightforward, but the impact is limited to reading low-sensitivity data (VC:L). No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated information disclosure in the StylemixThemes Motors WordPress plugin (car dealership and classified-listings plugin, all versions through 1.4.124) allows any remote visitor to retrieve sensitive data that the plugin embeds into the responses it sends to clients - for example internal configuration values, tokens, or other embedded secrets surfaced in rendered pages or AJAX/REST output. The CVSS 4.0 base score of 6.9 reflects a network-reachable, no-privilege, no-user-interaction, no-configuration-dependency attack path where the only impact is low-sensitivity confidentiality loss (VC:L, with no integrity or availability effect and no subsequent-system impact). No public exploit code has been identified at time of analysis and the CVE is not associated with CISA KEV, so exploitation is not confirmed as active.
RemediationAI
Patch availability is not confirmed by the supplied data - no fixed version number is provided, so the primary action is to check the Patchstack advisory for CVE-2026-104399 (https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-124-sensitive-data-exposure-vulnerability?_s_id=cve) and the StylemixThemes vendor channel for a patched Motors release, then upgrade as soon as a version above 1.4.124 is published; do not upgrade blindly without confirming the changelog addresses CWE-201 output leakage. If no fix is yet available, mitigate the exposure knowing the attack is unauthenticated and requires only reading a response: remove or disable the Motors plugin where the dealership/classifieds functionality is not essential (this eliminates the risk outright but removes the site feature), restrict public reachability of the plugin's listing, shortcode and AJAX/REST endpoints via WAF rules that inspect and block outbound response bodies containing secrets or by requiring authentication at the web-server layer (effective but may break public listing pages), rotate any credentials, API keys, or tokens that may have been embedded in plugin output and are therefore potentially exposed, and scan cached pages, CDN caches, and search-engine indexes for already-leaked values. Keep WordPress core and all other plugins patched, and monitor for requests to Motors endpoints as a detection signal, accepting that none of these controls repairs the underlying information-insertion defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-201 (Insertion of Sensitive Information Into Sent Data): rather than a missing authorization check or an injection flaw, the application builds an outbound response - HTML page markup, an AJAX handler payload, a REST/JSON response, or generated plugin output - and includes sensitive values that should never leave the server. Because the leaked data travels in the normal response body, exploitation requires no special request crafting beyond requesting the affected page or endpoint and inspecting what comes back. The affected code runs on the WordPress/PHP stack, distributed as the 'Motors' plugin (motor/car dealership and classified-listings theme companion) published by StylemixThemes; the CPE cpe:2.3:a:stylemixthemes:motors:*:*:*:*:*:*:*:* uses a wildcard version, and both the CVE record and ENISA EUVD-2026-93092 bound affected releases as 'n/a through 1.4.124' (no confirmed lower bound). The vendor-supplied CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N places the leak on a publicly reachable code path, while VC:L with SC/SI/SA:N confines the consequence to partial disclosure of low-sensitivity data; our independent CVSS 3.1 view (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, roughly 5.3 base) agrees on the mechanism and prerequisites but scores it lower than the 6.9 vendor/Patchstack figure. No CWE-200/CWE-201-style secondary impact such as credential theft or session hijack is established by the supplied data.
Know when Motors gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Unauthenticated network access with low complexity and no user interaction (PR:N/UI:N/AV:N/AC:L); confidentiality-only low impact per CWE-201 disclosure, so I:N and A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data.
This issue affects Motors: from n/a through 1.4.124.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Blind SQL injection in the StylemixThemes Motors WordPress plugin (versions up to and including 1.4.109) allows remote u
Unauthenticated post metadata tampering in the Motors WordPress plugin (all versions before 1.4.110) allows any remote a
Unauthenticated remote attackers can read any author's non-published car listings - including titles, prices, media URLs
Local file inclusion in StylemixThemes Motors WordPress plugin versions up to and including 1.4.109 allows remote attack
Unauthenticated remote attackers can invoke privileged actions or modify site data in the StylemixThemes Motors WordPres
Unauthorized data modification in the Motors car dealership and classified listings plugin for WordPress (versions <= 1.
Broken access control in the Motors WordPress plugin (StylemixThemes) prior to version 1.4.107 enables subscriber-level
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through versi
Broken access control in the Motors WordPress theme (by StyleMixThemes) versions 5.6.80 and earlier allows unauthenticat
Exploit-DB