CVE-2023-46207 MEDIUM

CVE-2023-46207: WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF)

Vendor Stylemixthemes
Product Motors – Car Dealer, Classifieds & Listing
Weakness CWE-918 · SSRF
Published November 13, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifieds & Listing: from n/a through 1.4.6.

Explanation of Vulnerability in Simple Terms

02Summary

Motors – Car Dealer, Classifieds & Listing through version 1.4.6 contains a server-side request forgery vulnerability. An authenticated administrator can craft requests that cause the site to make HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires high-level admin access and does not directly compromise user data, but can be used to probe internal infrastructure or interact with backend services.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal or external systems on the attacker's behalf.

Potential impact on your site

04Site Impact

An admin account compromise could allow an attacker to probe your internal network or interact with backend services without direct access.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

November 13, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57348 WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-24639 WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-39647 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-39521 WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-5737 Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route