Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured

Published 36 d ago 2026-10-02 · modified 35 d ago 2026-10-02 · JSON

CVSS

3.1

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.1%

percentile 3%

Public exploits

none known

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 36 d ago 2026-10-02

Exploit prediction (EPSS)

0.13% probability of exploitation in the next 30 days, higher than 3% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	3.1	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N`
CNA	3.1	3.1	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N`

Affected products

Unknown Motors

Classification

Weakness

CWE-862 Missing Authorization

References

wpscan.com /vulnerability/c2400c65-5d77-454c-9691-5e664556341b/ · exploit, vdb-entry, technical-description

Sources

CVE List: CVE-2026-91023
NVD: CVE-2026-91023

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary