8.1
Élevée
CVE-2025-10494 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion…
Description
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Motors – Car Dealership & Classified Listings Plugin 1.4 | premières → 1.4.89 | Pas de correctif indiqué |
Autres CVE de Motors – Car Dealership & Classified Listings Plugin
Les 17 CVE de Motors – Car Dealership & Classified Listings Plugin →
CVE-2026-104746
Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta
8.1
Élevée
CVE-2026-116562
Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter
6.4
Moyenne
CVE-2026-116617
Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
8.1
Élevée
CVE-2026-96563
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site…
6.4
Moyenne