CVE-2026-91016
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them. This allows unauthenticated attackers to read any author's draft, pending and private car listings — including titles, prices, media URLs and seller notes — by supplying only the target's numeric user id.
Risk Assessment
An attacker can access confidential information about unpublished listings, potentially violating seller privacy and exposing business data. The risk includes leakage of personal and commercial information.
Recommendation
Update the Motors plugin to version 1.4.121 or later. Check for any unauthorized access to unpublished listings.
Other vulnerabilities in Motors
See all- CVE-2026-54828High
Motors versions up to 1.4.109 have a vulnerability in access control that allows unauthorized access.
- CVE-2026-66693Medium
Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.
- CVE-2026-27433Medium
The Motors plugin versions up to 5.6.80 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass security measures and gain unauthorized access to functions or data.
- CVE-2026-39515Medium
Versions of the engine below 1.4.107 have a broken access control issue for subscribers, which may lead to unauthorized access to resources.
Original NVD description (English source)
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS