CVE-2026-91023
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Motors WordPress plugin before version 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions. This allows authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors plugin's paid featured-listing option is enabled, neither of which is a default configuration.
Risk Assessment
An attacker can manipulate product prices and listing metadata, leading to unauthorized changes in the shop and potential financial losses.
Recommendation
Update the Motors plugin to version 1.4.124 or later. Additionally, assess whether the paid featured-listing option is necessary, and restrict subscriber privileges.
Other vulnerabilities in Motors
See all- CVE-2026-54828High
Motors versions up to 1.4.109 have a vulnerability in access control that allows unauthorized access.
- CVE-2026-54812Critical
SQL Injection vulnerability in the Motors (motors-car-dealership-classified-listings) plugin by StylemixThemes allows an attacker to perform blind SQL injection. The issue affects versions from n/a through 1.4.109.
- CVE-2026-91022Medium
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
- CVE-2026-91016Medium
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them. This allows unauthenticated attackers to read any author's draft, pending and private car listings — including titles, prices, media URLs and seller notes — by supplying only the target's numeric user id.
- CVE-2026-66693Medium
Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.
- CVE-2026-27433Medium
The Motors plugin versions up to 5.6.80 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass security measures and gain unauthorized access to functions or data.
- CVE-2026-39515Medium
Versions of the engine below 1.4.107 have a broken access control issue for subscribers, which may lead to unauthorized access to resources.
Original NVD description (English source)
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS