CVE-2026-16750
MediumCVSS 5.3Summary
The Motors – Car Dealership & Classified Listings Plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
Risk Assessment
The vulnerability allows unauthorized individuals to access non-public listings, potentially leading to data leakage and privacy violations.
Recommendation
It is recommended to update the Motors plugin to the latest version that includes the fix. Also, restrict access to AJAX endpoints and implement proper authorization checks.
Other vulnerabilities in Motors – Car Dealership & Classified Listings Plugin
See all- CVE-2026-13114High
The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping.
- CVE-2026-12435Medium
The Motors – Car Dealership & Classified Listings plugin for WordPress up to version 1.4.111 is vulnerable to authorization bypass. An authenticated attacker with subscriber-level access can mark or unmark any other user's car listing as sold by replaying a valid nonce from their own listing.
Original NVD description (English source)
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.