CVE-2026-105971 · Package
NO FIX YET
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through version 4.73 has an unauthenticated AJAX action that returns single listings without checking they are published. An attacker who supplies a numeric post id can read the title, content and metadata of private, draft, pending, future or trashed posts.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Car Dealer (Dealership) and Vehicle sales WordPress plugin at version 4.73 or earlier are exposed, because the unauthenticated single-listing AJAX action reads posts without checking their status. Sites that do not run this plugin are not affected. The sources do not say which plugin version fixes this, so the team must confirm with the vendor.
Not affected if plugin-above-4.73, plugin-not-installed
Who cares self-hosted, wordpress, wordpress-plugin
car-dealer or the name "Car Dealer (Dealership) and Vehicle sales" under Plugins in the WordPress admin, and check whether its version is 4.73 or lower.wp plugin get <plugin-slug> --field=version using the slug shown in the plugin folder.No fix yet, per the sources.
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.