Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization

Wordfence Intelligence   >   Vulnerability Database   >   Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization
5.3
Missing Authorization
CVE CVE-2026-54828
CVSS 5.3 (Medium)
Publicly Published June 17, 2026
Last Updated June 23, 2026
Researcher Nguyen Dinh Hai (HaiND) - PTIT

Description

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.4.109. This makes it possible for unauthenticated attackers to perform an unauthorized action.

References

Share

Vulnerability Details for Motors – Car Dealership & Classified Listings Plugin

Motors – Car Dealership & Classified Listings Plugin

Software Type Plugin
Software Slug motors-car-dealership-classified-listings (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.4.110, or a newer patched version
Affected Version
  • <= 1.4.109
Patched Version
  • 1.4.110

Recent vulnerabilities in Motors – Car Dealership & Classified Listings Plugin

Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
7.2
CVE-2026-13114
Jul 10, 2026
Researcher: Webbernaut
Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
4.3
CVE-2026-12435
Jun 30, 2026
Researcher: Michael Perla (vizen5)
Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery
4.3
CVE-2026-7859
Jun 22, 2026
Researcher: Mustafa
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection
7.5
CVE-2026-54812
Jun 17, 2026
Researcher: endy
Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion
7.5
CVE-2026-54814
Jun 17, 2026
Researcher: endy
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
8.1
CVE-2026-3892
May 13, 2026
Researcher: Leonid Semenenko (lsemenenko)
Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
4.3
CVE-2026-1934
May 11, 2026
Researcher: shrikant bhosale
Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization
4.3
CVE-2026-39515
Apr 21, 2026
Researcher: Jakub Herman
Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion
8.1
CVE-2025-10494
Oct 7, 2025
Researcher: Kishan Vyas
Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2025-54691
Jul 30, 2025
Researcher: Bao - BlueRock
# Title CVE ID CVSS Researchers Date
1 Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info CVE-2026-13114 7.2 Webbernaut July 10, 2026
2 Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter CVE-2026-12435 4.3 Michael Perla (vizen5) June 30, 2026
3 Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery CVE-2026-7859 4.3 Mustafa June 22, 2026
4 Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection CVE-2026-54812 7.5 endy June 17, 2026
5 Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion CVE-2026-54814 7.5 endy June 17, 2026
6 Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter CVE-2026-3892 8.1 Leonid Semenenko (lsemenenko) May 13, 2026
7 Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter CVE-2026-1934 4.3 shrikant bhosale May 11, 2026
8 Motors – Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization CVE-2026-39515 4.3 Jakub Herman April 21, 2026
9 Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2025-10494 8.1 Kishan Vyas October 7, 2025
10 Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference CVE-2025-54691 5.3 Bao - BlueRock July 30, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation