CVE-2026-104399

Motors versions up to 1.4.109 have a vulnerability in access control that allows unauthorized access.

SQL Injection vulnerability in the Motors (motors-car-dealership-classified-listings) plugin by StylemixThemes allows an attacker to perform blind SQL injection. The issue affects versions from n/a through 1.4.109.

The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to and including 1.4.123 due to insufficient input sanitization and output escaping.

The Motors plugin by StylemixThemes is vulnerable to Missing Authorization in versions up to and including 1.4.108, allowing exploitation of incorrectly configured access control security levels.

The Motors WordPress plugin before version 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions. This allows authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors plugin's paid featured-listing option is enabled, neither of which is a default configuration.

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them. This allows unauthenticated attackers to read any author's draft, pending and private car listings — including titles, prices, media URLs and seller notes — by supplying only the target's numeric user id.

Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.

The Motors plugin versions up to 5.6.80 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass security measures and gain unauthorized access to functions or data.

Versions of the engine below 1.4.107 have a broken access control issue for subscribers, which may lead to unauthorized access to resources.