Vulnerabilities / Motors / WPSEC-2026-2361
Motors <= 1.4.128 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Profile Image Path Fields
Medium 5.4
CWE-73Fixed in 1.4.129
- ID
- WPSEC-2026-2361
- Plugin
- Motors – Car Dealership & Classified Listings Plugin (motors-car-dealership-classified-listings)
- Affected
- all versions before 1.4.129
- Remediation
- Update to 1.4.129 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-73
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Motors on WPSec AttackSurface
- Fix released
- Published
Description
The Motors plugin for WordPress is vulnerable to limited arbitrary file deletion via the 'stm_user_avatar_path' and 'stm_dealer_logo_path' profile fields in all versions up to, and including, 1.4.128. This is due to missing capability checks when saving these user meta values, which are later passed to unlink() when the images are replaced or removed. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary image files within the uploads directory, including images belonging to other users.
References
- https://wpsec.com/vuln/WPSEC-2026-2361/
- https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/tags/1.4.129/
- https://wordpress.org/plugins/motors-car-dealership-classified-listings/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS