CVE-2026-16750: Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Motors – Car Dealership & Classified Listings Pluginto a version that resolves this vulnerability.Fixed in 1.4.120 - Compensating control
Restrict access to the plugin’s AJAX endpoint(s) that use mvl_ajax_dealer_load_cars() so that unauthenticated users cannot retrieve draft/pending/private/future listings (e.g., block the endpoint path at the web server/WAF or require authentication at the network edge).
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it; no account or user interaction is required. The issue affects sites using the plugin in versions up to and including 1.4.120.
What information could be exposed?
An attacker can retrieve car listings that are not intended to be public, including draft, pending, private, password-protected, and future listings. The affected listings may belong to arbitrary users.
How can I determine whether my site is affected?
Check whether the Motors – Car Dealership & Classified Listings WordPress plugin is installed and whether its version is 1.4.120 or earlier. Sites using an affected version should assume non-public vehicle listings may be retrievable without authentication.