CVE-2026-91023: Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Motors – Car Dealership & Classified Listings WordPress pluginto a version that resolves this vulnerability.Fixed in 1.4.124
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use a Motors version earlier than 1.4.124, have WooCommerce active, and have the plugin’s paid featured-listing option enabled. WooCommerce and that option are not enabled by default.
What access does an attacker need?
An attacker must be authenticated with at least subscriber-level access. No user interaction is required, but the attack has high complexity.
What could an attacker change?
A qualifying low-privileged user can set metadata on listings they do not own. This can include overwriting product prices.
How can I determine whether immediate mitigation is necessary?
Check whether Motors is below version 1.4.124, WooCommerce is active, and the paid featured-listing option is enabled. The issue is exploitable only when all of those conditions are present.