Motors
Monthly
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through version 1.4.113 allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher roles, resulting in a high integrity impact. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in the Motors WordPress theme (by StyleMixThemes) versions 5.6.80 and earlier allows unauthenticated remote attackers to perform unauthorized actions, resulting in limited integrity and availability impact without requiring any credentials or user interaction. The vulnerability stems from CWE-862 (Missing Authorization), where specific theme functionality fails to enforce permission checks before executing sensitive operations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack profile makes opportunistic exploitation straightforward for any threat actor targeting WordPress installations.
Unauthorized data modification in the Motors car dealership and classified listings plugin for WordPress (versions <= 1.4.109) lets remote unauthenticated attackers invoke privileged actions they should not reach, due to a missing authorization check (CWE-862). The CVSS 3.1 vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are required, with a high integrity impact but no confidentiality or availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated post metadata tampering in the Motors WordPress plugin (all versions before 1.4.110) allows any remote attacker to overwrite arbitrary post metadata - including gallery images, featured images, and, critically, WooCommerce product prices - without any credentials or CSRF token. The missing authorization and CSRF checks on an AJAX action (CWE-862) are confirmed by WPScan, who also published a proof-of-concept. The SSVC assessment flags this as automatable, meaning mass exploitation via scripted scanning is realistic, though EPSS sits at only 0.12% (2nd percentile), indicating exploitation has not yet become widespread.
Blind SQL injection in the StylemixThemes Motors WordPress plugin (versions up to and including 1.4.109) allows remote unauthenticated attackers to inject crafted SQL fragments into backend queries, leading to confidentiality compromise of the WordPress database and limited availability impact. The CVSS 3.1 base score of 9.3 reflects a scope change (S:C), meaning the impact extends beyond the plugin to the underlying database engine shared with the WordPress core. No public exploit identified at time of analysis, but the SQLi class and unauthenticated network vector make this a high-priority issue for sites running the Motors car dealership/classified listings plugin.
Local file inclusion in StylemixThemes Motors WordPress plugin versions up to and including 1.4.109 allows remote attackers to include arbitrary PHP files from the server filesystem. The flaw is classified as CWE-98 (PHP Remote File Inclusion) but is exploitable only as LFI per the vendor description, enabling source code disclosure, sensitive file read, and potential code execution if a writable PHP file can be reached. No public exploit identified at time of analysis and the vulnerability is not present in CISA KEV.
Broken access control in the Motors WordPress plugin (StylemixThemes) prior to version 1.4.107 enables subscriber-level authenticated users to invoke privileged actions that trigger a high availability impact, without passing appropriate authorization checks. Reported by Patchstack and tracked under EUVD-2026-36954, this flaw targets WordPress sites running an unpatched Motors plugin where the lowest default user role - subscriber - can reach restricted functionality. No public exploit has been identified at time of analysis and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through version 1.4.113 allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher roles, resulting in a high integrity impact. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken access control in the Motors WordPress theme (by StyleMixThemes) versions 5.6.80 and earlier allows unauthenticated remote attackers to perform unauthorized actions, resulting in limited integrity and availability impact without requiring any credentials or user interaction. The vulnerability stems from CWE-862 (Missing Authorization), where specific theme functionality fails to enforce permission checks before executing sensitive operations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack profile makes opportunistic exploitation straightforward for any threat actor targeting WordPress installations.
Unauthorized data modification in the Motors car dealership and classified listings plugin for WordPress (versions <= 1.4.109) lets remote unauthenticated attackers invoke privileged actions they should not reach, due to a missing authorization check (CWE-862). The CVSS 3.1 vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are required, with a high integrity impact but no confidentiality or availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated post metadata tampering in the Motors WordPress plugin (all versions before 1.4.110) allows any remote attacker to overwrite arbitrary post metadata - including gallery images, featured images, and, critically, WooCommerce product prices - without any credentials or CSRF token. The missing authorization and CSRF checks on an AJAX action (CWE-862) are confirmed by WPScan, who also published a proof-of-concept. The SSVC assessment flags this as automatable, meaning mass exploitation via scripted scanning is realistic, though EPSS sits at only 0.12% (2nd percentile), indicating exploitation has not yet become widespread.
Blind SQL injection in the StylemixThemes Motors WordPress plugin (versions up to and including 1.4.109) allows remote unauthenticated attackers to inject crafted SQL fragments into backend queries, leading to confidentiality compromise of the WordPress database and limited availability impact. The CVSS 3.1 base score of 9.3 reflects a scope change (S:C), meaning the impact extends beyond the plugin to the underlying database engine shared with the WordPress core. No public exploit identified at time of analysis, but the SQLi class and unauthenticated network vector make this a high-priority issue for sites running the Motors car dealership/classified listings plugin.
Local file inclusion in StylemixThemes Motors WordPress plugin versions up to and including 1.4.109 allows remote attackers to include arbitrary PHP files from the server filesystem. The flaw is classified as CWE-98 (PHP Remote File Inclusion) but is exploitable only as LFI per the vendor description, enabling source code disclosure, sensitive file read, and potential code execution if a writable PHP file can be reached. No public exploit identified at time of analysis and the vulnerability is not present in CISA KEV.
Broken access control in the Motors WordPress plugin (StylemixThemes) prior to version 1.4.107 enables subscriber-level authenticated users to invoke privileged actions that trigger a high availability impact, without passing appropriate authorization checks. Reported by Patchstack and tracked under EUVD-2026-36954, this flaw targets WordPress sites running an unpatched Motors plugin where the lowest default user role - subscriber - can reach restricted functionality. No public exploit has been identified at time of analysis and CISA has not listed this in the Known Exploited Vulnerabilities catalog.