5.3
Moyenne
CVE-2026-16750 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of…
Description
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Motors – Car Dealership & Classified Listings Plugin 1.4 | premières → 1.4.120 | Pas de correctif indiqué |
Autres CVE de Motors – Car Dealership & Classified Listings Plugin
Les 17 CVE de Motors – Car Dealership & Classified Listings Plugin →
CVE-2026-104746
Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta
8.1
Élevée
CVE-2026-116562
Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter
6.4
Moyenne
CVE-2026-116617
Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
8.1
Élevée
CVE-2026-96563
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site…
6.4
Moyenne