What the vulnerability does
01Description
The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.6.65. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
*It is unclear exactly which version the issue was patched in from the changelog. Therefore, we used the latest version at the time of verification.
Explanation of Vulnerability in Simple Terms
02Summary
The Motors WordPress theme contains a code injection vulnerability in versions up to 5.6.65. An unauthenticated attacker can inject and execute arbitrary code on the site without user interaction. This allows complete compromise of the WordPress installation, including data theft and malware installation. Site owners should update immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Inject and execute arbitrary code on the site without authentication.
Potential impact on your site
04Site Impact
Complete site compromise: attacker can steal data, install malware, modify content, or take full control.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 3, 2025
CVE published
April 8, 2026
Record updated
