What the vulnerability does
01Description
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.4.107. This is due to insufficient file path validation in the become-dealer logo upload flow. The plugin allows any authenticated user to set an arbitrary filesystem path via the profile update handler. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary files on the server.
Explanation of Vulnerability in Simple Terms
02Summary
The Motors Car Dealership & Classified Listings Plugin for WordPress contains a vulnerability that allows authenticated users to modify or delete site data without proper authorization checks. An attacker with low-level account access can alter listings, settings, or other critical information. The vulnerability affects all versions up to 1.4.107. Site administrators should update immediately when a patch becomes available.
What an attacker can do
03Attacker Capabilities
Modify or delete site data and listings without authorization.
Potential impact on your site
04Site Impact
Authenticated users can corrupt or delete car listings and site configuration, disrupting the dealership site's operation.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
