--- id: "CVE-2026-105971" kind: "vulnerability" aliases: ["CVE-2026-105971"] title: "WordPress car dealer plugin leaks private and draft listings to anyone" severity: "medium" cvss: null epss: null exploited: false status: "open" category: "package" products: [] ecosystems: [] tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"] not_affected_if: ["plugin-above-4.73", "plugin-not-installed"] published_at: "2026-11-05T06:17:06+00:00" first_seen_at: "2026-11-05T06:31:51+00:00" updated_at: "2026-11-05T06:33:19+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105971", "first_seen_at": "2026-11-05T06:31:51+00:00"}] exploit_sources: [] --- # WordPress car dealer plugin leaks private and draft listings to anyone The Car Dealer (Dealership) and Vehicle sales WordPress plugin through version 4.73 has an unauthenticated AJAX action that returns single listings without checking they are published. An attacker who supplies a numeric post id can read the title, content and metadata of private, draft, pending, future or trashed posts. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Look for the plugin folder `car-dealer` or the name "Car Dealer (Dealership) and Vehicle sales" under Plugins in the WordPress admin, and check whether its version is `4.73` or lower. - Check the installed version with `wp plugin get --field=version` using the slug shown in the plugin folder. ## Timeline - 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105971 ## From the sources The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_