# Motors <= 1.4.128 - Authenticated (Subscriber+) Limited Arbitrary File Deletion via Profile Image Path Fields

- **ID:** WPSEC-2026-2361
- **Plugin:** Motors – Car Dealership & Classified Listings Plugin (`motors-car-dealership-classified-listings`), https://wordpress.org/plugins/motors-car-dealership-classified-listings/
- **Affected versions:** all versions before 1.4.129
- **Fixed in:** 1.4.129 (Update to 1.4.129 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-73
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/motors-car-dealership-classified-listings
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2361/

## Description

The Motors plugin for WordPress is vulnerable to limited arbitrary file deletion via the 'stm_user_avatar_path' and 'stm_dealer_logo_path' profile fields in all versions up to, and including, 1.4.128. This is due to missing capability checks when saving these user meta values, which are later passed to unlink() when the images are replaced or removed. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary image files within the uploads directory, including images belonging to other users.

## References

- https://wpsec.com/vuln/WPSEC-2026-2361/
- https://plugins.svn.wordpress.org/motors-car-dealership-classified-listings/tags/1.4.129/
- https://wordpress.org/plugins/motors-car-dealership-classified-listings/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2361/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.