{"id":"CVE-2026-104746","kind":"vulnerability","aliases":["CVE-2026-104746"],"related":[],"title":"WordPress Motors car dealership plugin lets subscribers delete arbitrary uploaded files","description":"The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler's stm_user_avatar_path meta is writable by any logged-in user against their own account.","summary":"The Motors car dealership and classified listings plugin for WordPress fails to validate file paths in its user data save handler. Any logged-in subscriber can delete files under wp-content/uploads, and deleting the right file can lead to remote code execution.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["motors-plugin","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed"],"how_to_check":"- Check whether the Motors plugin is installed and its version in the WordPress admin under Plugins.\n- Look for the plugin version in `wp-content/plugins/` header of the main plugin file.\n- Confirm whether subscriber accounts can register on the site.","fix":"- Versions up to and including `1.4.125` are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-11-07T12:17:41+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:48:39+00:00","updated_at":"2026-11-07T12:48:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T12:48:39Z","model":"claude-haiku-5-5","output":{"fix":"- Versions up to and including `1.4.125` are affected; the sources do not state a fixed version.","reach":"internet","title":"WordPress Motors car dealership plugin lets subscribers delete arbitrary uploaded files","impact":"high","summary":"The Motors car dealership and classified listings plugin for WordPress fails to validate file paths in its user data save handler. Any logged-in subscriber can delete files under wp-content/uploads, and deleting the right file can lead to remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","motors-plugin","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated subscriber deletes server files, possibly enabling code execution","analyst_note":"Confirm the fixed version of the Motors plugin after 1.4.125 and whether a vendor patch exists, using the NVD entry and the plugin's changelog.","how_to_check":"- Check whether the Motors plugin is installed and its version in the WordPress admin under Plugins.\n- Look for the plugin version in `wp-content/plugins/` header of the main plugin file.\n- Confirm whether subscriber accounts can register on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-accounts"],"who_is_affected":"Sites running the Motors car dealership and classified listings WordPress plugin at version 1.4.125 or earlier that allow subscriber-level accounts. Sites without this plugin, or where no one can log in, are not exposed. The sources do not say whether non-default configurations change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4392,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104746':14A,17A '-2026':13A,16A '/uploads':62B,159C '1.4.125':112C 'access':124C 'account':204C 'ajax':100C,174C 'although':151C 'arbitrari':9A,87C,129C 'attack':119C 'authent':118C,165C 'avatar':190C 'bound':154C 'car':3A,31B,76C 'classifi':34B,78C 'code':72B,140C 'content':61B,158C 'cve':12A,15A 'data':47B,103C 'dealership':4A,32B,77C 'delet':8A,56B,64B,89C,128C,147C,152C 'due':90C 'easili':136C 'end':182C 'everi':179C 'execut':73B,141C 'exploit':169C 'fail':39B 'file':11A,42B,57B,67B,88C,93C,130C,145C 'front':181C 'front-end':180C 'function':104C 'handler':49B,186C 'host':24B 'includ':111C 'insuffici':92C 'lead':69B,137C 'let':6A 'level':123C 'list':35B,79C,99C 'log':52B,198C 'logged-in':51B,197C 'make':114C 'meta':192C 'motor':2A,19B,30B,75C 'motors-plugin':18B 'nonc':175C 'packag':21B 'page':183C 'path':43B,94C,191C 'plugin':5A,20B,28B,36B,80C,81C 'possibl':116C 'prevent':160C 'print':177C 'remot':71B,139C 'remov':161C 'requir':173C 'right':66B,144C 'save':48B,101C 'self':23B 'self-host':22B 'server':133C 'stm':98C,188C 'subscrib':7A,54B,122C,166C 'subscriber-level':121C 'trivial':168C 'upload':10A 'user':46B,102C,189C,200C 'valid':41B,95C 'version':107C 'vulner':85C 'wordpress':1A,25B,27B,38B,83C 'wordpress-plugin':26B 'wp':60B,157C 'wp-config.php':150C,163C 'wp-content':59B,156C 'writabl':194C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Motors car dealership and classified listings WordPress plugin at version 1.4.125 or earlier that allow subscriber-level accounts. Sites without this plugin, or where no one can log in, are not exposed. The sources do not say whether non-default configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","motorsplugin","package","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-104746':14A,17A '-2026':13A,16A 'arbitrari':9A 'car':3A 'cve':12A,15A 'dealership':4A 'delet':8A 'file':11A 'let':6A 'motor':2A 'plugin':5A 'subscrib':7A 'upload':10A 'wordpress':1A","search_b":"'/uploads':62B 'car':31B 'classifi':34B 'code':72B 'content':61B 'data':47B 'dealership':32B 'delet':56B,64B 'execut':73B 'fail':39B 'file':42B,57B,67B 'handler':49B 'host':24B 'lead':69B 'list':35B 'log':52B 'logged-in':51B 'motor':19B,30B 'motors-plugin':18B 'packag':21B 'path':43B 'plugin':20B,28B,36B 'remot':71B 'right':66B 'save':48B 'self':23B 'self-host':22B 'subscrib':54B 'user':46B 'valid':41B 'wordpress':25B,27B,38B 'wordpress-plugin':26B 'wp':60B 'wp-content':59B","search_c":"'/uploads':159C '1.4.125':112C 'access':124C 'account':204C 'ajax':100C,174C 'although':151C 'arbitrari':87C,129C 'attack':119C 'authent':118C,165C 'avatar':190C 'bound':154C 'car':76C 'classifi':78C 'code':140C 'content':158C 'data':103C 'dealership':77C 'delet':89C,128C,147C,152C 'due':90C 'easili':136C 'end':182C 'everi':179C 'execut':141C 'exploit':169C 'file':88C,93C,130C,145C 'front':181C 'front-end':180C 'function':104C 'handler':186C 'includ':111C 'insuffici':92C 'lead':137C 'level':123C 'list':79C,99C 'log':198C 'logged-in':197C 'make':114C 'meta':192C 'motor':75C 'nonc':175C 'page':183C 'path':94C,191C 'plugin':80C,81C 'possibl':116C 'prevent':160C 'print':177C 'remot':139C 'remov':161C 'requir':173C 'right':144C 'save':101C 'server':133C 'stm':98C,188C 'subscrib':122C,166C 'subscriber-level':121C 'trivial':168C 'user':102C,189C,200C 'valid':95C 'version':107C 'vulner':85C 'wordpress':83C 'wp':157C 'wp-config.php':150C,163C 'wp-content':156C 'writabl':194C","first_public_at":"2026-11-07T12:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104746","severity":null,"published_at":"2026-11-07T12:17:41+00:00","modified_at":"2026-11-07T12:17:41+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}