CVE-2026-7859: Motors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media
The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary post metadata, such as the gallery, featured image and, on WooCommerce sites, product prices.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7859?
CVE-2026-7859 has a risk score of 70, indicating a high severity vulnerability.
How do I fix CVE-2026-7859?
To fix CVE-2026-7859, update the Motors WordPress plugin to version 1.4.110 or later.
What types of attacks are possible with CVE-2026-7859?
CVE-2026-7859 allows unauthenticated attackers to modify post metadata, including gallery images and product prices.
Which versions of the Motors plugin are affected by CVE-2026-7859?
CVE-2026-7859 affects all versions of the Motors WordPress plugin prior to 1.4.110.
What is the impact of CVE-2026-7859 on WooCommerce sites?
On WooCommerce sites, CVE-2026-7859 can allow attackers to modify product prices through unauthorized post metadata changes.