CVE-2026-91016: Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure

Q: Who can exploit this issue?

Any unauthenticated remote attacker can exploit it. The attacker only needs the numeric WordPress user ID of the author whose listings they want to access.

Q: What information can be disclosed?

Affected sites may expose non-published car listings in draft, pending, or private status. Disclosed data can include listing titles, prices, media URLs, and seller notes.

Q: Which installations are affected?

Motors WordPress plugin versions before 1.4.121 are affected. The vulnerable behavior occurs when requests for a user's non-published listings are not authorization-checked.

Published Sep 17, 2026

Updated

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.

Affected Software

1 affected component

Motors WordPress plugin<1.4.121

Event History

Sep 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can exploit it. The attacker only needs the numeric WordPress user ID of the author whose listings they want to access.

What information can be disclosed?

Affected sites may expose non-published car listings in draft, pending, or private status. Disclosed data can include listing titles, prices, media URLs, and seller notes.

Which installations are affected?

Motors WordPress plugin versions before 1.4.121 are affected. The vulnerable behavior occurs when requests for a user's non-published listings are not authorization-checked.