CVE-2026-116617: Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because stmsaveuserextrafields(), hooked to personaloptionsupdate, writes the attacker-controlled stmdealerlogopath parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the stmpaymentstatus and stmlostpasswordhash fields, this field is not gated by a manageoptions or editusers capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under wp-content/uploads — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering unlink() through the become-dealer form on their author page. Note that the two path guards (stmmvlispathwithinuploads and stmmvlisallowedimagefile) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as wp-config.php or plugin PHP files, cannot be reached.