CVE-2026-105971: Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax

Q: Who is exposed to this issue?

Sites using the affected plugin through version 4.73 are exposed if the cardealer_single_car_ajax action is reachable. No authentication is required to retrieve affected listing data.

Q: What does an attacker need to exploit it?

An attacker only needs the numeric ID of a target post. They can use that ID to request its title, content, and metadata even when the post is private, draft, pending, scheduled, or trashed.

Q: How can I tell whether sensitive content may already be exposed?

Review non-public posts in the affected site, especially vehicle listings and other posts containing sensitive titles, content, or metadata. Any such post with a numeric ID may be readable through the vulnerable AJAX action.

Published Nov 5, 2026

Updated

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Sites using the affected plugin through version 4.73 are exposed if the cardealer_single_car_ajax action is reachable. No authentication is required to retrieve affected listing data.

What does an attacker need to exploit it?

An attacker only needs the numeric ID of a target post. They can use that ID to request its title, content, and metadata even when the post is private, draft, pending, scheduled, or trashed.

How can I tell whether sensitive content may already be exposed?

Review non-public posts in the affected site, especially vehicle listings and other posts containing sensitive titles, content, or metadata. Any such post with a numeric ID may be readable through the vulnerable AJAX action.

CVE-2026-105971: Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether sensitive content may already be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether sensitive content may already be exposed?