{"id":"CVE-2026-105971","kind":"vulnerability","aliases":["CVE-2026-105971"],"related":[],"title":"WordPress car dealer plugin leaks private and draft listings to anyone","description":"The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.","summary":"The Car Dealer (Dealership) and Vehicle sales WordPress plugin through version 4.73 has an unauthenticated AJAX action that returns single listings without checking they are published. An attacker who supplies a numeric post id can read the title, content and metadata of private, draft, pending, future or trashed posts.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-above-4.73","plugin-not-installed"],"how_to_check":"- Look for the plugin folder `car-dealer` or the name \"Car Dealer (Dealership) and Vehicle sales\" under Plugins in the WordPress admin, and check whether its version is `4.73` or lower.\n- Check the installed version with `wp plugin get <plugin-slug> --field=version` using the slug shown in the plugin folder.","fix":null,"status":"open","published_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:19+00:00","updated_at":"2026-11-05T06:33:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress car dealer plugin leaks private and draft listings to anyone","impact":"medium","summary":"The Car Dealer (Dealership) and Vehicle sales WordPress plugin through version 4.73 has an unauthenticated AJAX action that returns single listings without checking they are published. An attacker who supplies a numeric post id can read the title, content and metadata of private, draft, pending, future or trashed posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"private and draft post content and metadata readable by anyone","analyst_note":"Confirm the fixed version and the plugin slug from the vendor or NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105971.","how_to_check":"- Look for the plugin folder `car-dealer` or the name \"Car Dealer (Dealership) and Vehicle sales\" under Plugins in the WordPress admin, and check whether its version is `4.73` or lower.\n- Check the installed version with `wp plugin get <plugin-slug> --field=version` using the slug shown in the plugin folder.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-4.73"],"who_is_affected":"Sites running the Car Dealer (Dealership) and Vehicle sales WordPress plugin at version 4.73 or earlier are exposed, because the unauthenticated single-listing AJAX action reads posts without checking their status. Sites that do not run this plugin are not affected. The sources do not say which plugin version fixes this, so the team must confirm with the vendor.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":4235,"output_tokens":662,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105971':14A,17A '-2026':13A,16A '4.73':37B,85C 'action':42B,95C 'ajax':41B,94C 'allow':99C 'anyon':11A 'attack':53B,102C 'car':2A,27B,76C 'check':48B 'content':64B,98C,107C 'cve':12A,15A 'dealer':3A,28B,77C 'dealership':29B,78C 'draft':8A,69B,113C 'futur':71B,115C 'host':21B 'id':59B,123C 'leak':5A 'list':9A,46B,93C 'metadata':66B,109C 'numer':57B,122C 'packag':18B 'pend':70B,114C 'plugin':4A,25B,34B,83C 'post':58B,74B,118C 'privat':6A,68B,112C 'publish':51B,97C 'read':61B,104C 'restrict':88C 'return':44B 'sale':32B,81C 'self':20B 'self-host':19B 'singl':45B,92C 'single-list':91C 'suppli':55B,120C 'titl':63B,106C 'trash':73B,117C 'unauthent':40B,90C,101C 'vehicl':31B,80C 'version':36B 'without':47B 'wordpress':1A,22B,24B,33B,82C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Car Dealer (Dealership) and Vehicle sales WordPress plugin at version 4.73 or earlier are exposed, because the unauthenticated single-listing AJAX action reads posts without checking their status. Sites that do not run this plugin are not affected. The sources do not say which plugin version fixes this, so the team must confirm with the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105971","severity":null,"published_at":"2026-11-05T06:17:06+00:00","modified_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}