CVE-2026-104746: Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta

Q: Which users can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The affected user-meta field is writable by logged-in users for their own accounts.

Q: Does exploitation require access to the WordPress administration area or a secret nonce?

No. The required AJAX nonce is printed on every front-end page, so a logged-in Subscriber can obtain it without administrative access.

Q: Can this vulnerability delete wp-config.php or other files outside uploads?

No. File deletion is bounded to the wp-content/uploads directory, which prevents deletion of wp-config.php. However, an attacker can delete arbitrary files within that uploads location.

Q: How can I determine whether my site is affected?

Sites using the Motors – Car Dealership & Classified Listings Plugin version 1.4.125 or earlier are affected according to the available information. The vulnerable behavior is in the stm_listings_ajax_save_user_data function and involves the stm_user_avatar_path user-meta value.

Published Nov 7, 2026

Updated

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stmlistingsajaxsaveuserdata function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler's stmuseravatarpath meta is writable by any logged-in user against their own account.

Event History

Nov 7, 2026

CVE Published

via MITRE·11:26 AM

Data Sourced

via MITRE·11:26 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The affected user-meta field is writable by logged-in users for their own accounts.

Does exploitation require access to the WordPress administration area or a secret nonce?

No. The required AJAX nonce is printed on every front-end page, so a logged-in Subscriber can obtain it without administrative access.

Can this vulnerability delete wp-config.php or other files outside uploads?

No. File deletion is bounded to the wp-content/uploads directory, which prevents deletion of wp-config.php. However, an attacker can delete arbitrary files within that uploads location.

How can I determine whether my site is affected?

Sites using the Motors – Car Dealership & Classified Listings Plugin version 1.4.125 or earlier are affected according to the available information. The vulnerable behavior is in the stm_listings_ajax_save_user_data function and involves the stm_user_avatar_path user-meta value.

CVE-2026-104746: Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta

Event History

Frequently Asked Questions

Which users can exploit this issue?

Does exploitation require access to the WordPress administration area or a secret nonce?

Can this vulnerability delete wp-config.php or other files outside uploads?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Does exploitation require access to the WordPress administration area or a secret nonce?

Can this vulnerability delete wp-config.php or other files outside uploads?

How can I determine whether my site is affected?