CVE-2026-54812

Motors versions up to 1.4.109 have a vulnerability in access control that allows unauthorized access.

The Motors WordPress plugin before version 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions. This allows authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors plugin's paid featured-listing option is enabled, neither of which is a default configuration.

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them. This allows unauthenticated attackers to read any author's draft, pending and private car listings — including titles, prices, media URLs and seller notes — by supplying only the target's numeric user id.

Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.

The Motors plugin versions up to 5.6.80 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass security measures and gain unauthorized access to functions or data.

Versions of the engine below 1.4.107 have a broken access control issue for subscribers, which may lead to unauthorized access to resources.