{
 "id": "WPSEC-2026-2361",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2361/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2361/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2361/index.md",
 "title": "Motors <= 1.4.128 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Profile Image Path Fields",
 "description": "The Motors plugin for WordPress is vulnerable to limited arbitrary file deletion via the 'stm_user_avatar_path' and 'stm_dealer_logo_path' profile fields in all versions up to, and including, 1.4.128. This is due to missing capability checks when saving these user meta values, which are later passed to unlink() when the images are replaced or removed. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary image files within the uploads directory, including images belonging to other users.",
 "plugin": {
  "slug": "motors-car-dealership-classified-listings",
  "name": "Motors",
  "full_name": "Motors – Car Dealership & Classified Listings Plugin",
  "wordpress_org": "https://wordpress.org/plugins/motors-car-dealership-classified-listings/",
  "advisories_url": "https://wpsec.com/vuln/plugin/motors-car-dealership-classified-listings/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/motors-car-dealership-classified-listings"
 },
 "type": "FILE DELETION",
 "cwe": [
  "CWE-73"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.129",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.129"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.129",
 "remediation": "Update to 1.4.129 or later.",
 "fix_released": "2026-10-30T09:18:51+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:40:20.084000+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2361/",
  "https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/tags/1.4.129/",
  "https://wordpress.org/plugins/motors-car-dealership-classified-listings/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/motors-car-dealership-classified-listings",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}