WordPress Motors plugin: subscribers can delete other users' uploaded images

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because stm_save_user_extra_fields(), hooked to personal_options_update, writes the attacker-controlled stm_dealer_logo_path parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the stm_payment_status and stm_lost_password_hash fields, this field is not gated by a manage_options or edit_users capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under wp-content/uploads — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering unlink() through the become-dealer form on their author page. Note that the two path guards (stm_mvl_is_path_within_uploads and stm_mvl_is_allowed_image_file) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as or plugin PHP files, cannot be reached.