CVE-2026-123467: WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability

Q: Is a remediated version identified in the available advisory data?

No. The available data identifies affected releases through 1.4.128 but does not identify a fixed release.

Q: Does the available information specify an attacker prerequisite, such as authentication or a particular role?

No. It does not state whether exploitation requires an account, a specific privilege level, or any other prerequisite.

Q: Can the available data determine whether a default installation is affected?

No. It does not describe default configuration behavior or identify the access-control configuration conditions required for exploitation.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Motors plugin to a version that resolves this vulnerability.
Fixed in 1.4.129

Event History

Nov 7, 2026

CVE Published

via MITRE·12:40 PM

Data Sourced

via MITRE·12:40 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Is a remediated version identified in the available advisory data?

No. The available data identifies affected releases through 1.4.128 but does not identify a fixed release.

Does the available information specify an attacker prerequisite, such as authentication or a particular role?

No. It does not state whether exploitation requires an account, a specific privilege level, or any other prerequisite.

Can the available data determine whether a default installation is affected?

No. It does not describe default configuration behavior or identify the access-control configuration conditions required for exploitation.

CVE-2026-123467: WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Is a remediated version identified in the available advisory data?

Does the available information specify an attacker prerequisite, such as authentication or a particular role?

Can the available data determine whether a default installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Is a remediated version identified in the available advisory data?

Does the available information specify an attacker prerequisite, such as authentication or a particular role?

Can the available data determine whether a default installation is affected?