{"id":"CVE-2026-116617","kind":"vulnerability","aliases":["CVE-2026-116617"],"related":[],"title":"WordPress Motors plugin: subscribers can delete other users' uploaded images","description":"The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under `wp-content/uploads` — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering `unlink()` through the become-dealer form on their author page. Note that the two path guards (`stm_mvl_is_path_within_uploads` and `stm_mvl_is_allowed_image_file`) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as `wp-config.php` or plugin PHP files, cannot be reached.","summary":"The Motors car dealership plugin for WordPress lets a logged-in subscriber store a crafted file path in their profile and then delete image files under wp-content/uploads that belong to other users, including avatars and dealer logos. Files outside the uploads directory, such as wp-config.php, cannot be reached according to the description.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["motors-plugin","package","wordpress","wordpress-plugin"],"not_affected_if":["newer-version","plugin-not-installed","registration-closed"],"how_to_check":"- Check the installed version of the Motors plugin in the WordPress admin plugins list; versions up to and including `1.4.128` are affected.\n- Look for the `stm_save_user_extra_fields` function and the `stm_dealer_logo_path` user meta key in the plugin code.\n- Confirm whether user registration lets new accounts sign up as Subscriber.","fix":"- Move the Motors plugin to a version later than `1.4.128`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-05T05:18:19+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","triaged_at":"2026-11-05T05:33:39+00:00","updated_at":"2026-11-05T05:33:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T05:33:39Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Motors plugin to a version later than `1.4.128`; the sources do not name the fixed version.","reach":"internet","title":"WordPress Motors plugin: subscribers can delete other users' uploaded images","impact":"medium","summary":"The Motors car dealership plugin for WordPress lets a logged-in subscriber store a crafted file path in their profile and then delete image files under wp-content/uploads that belong to other users, including avatars and dealer logos. Files outside the uploads directory, such as wp-config.php, cannot be reached according to the description.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","motors-plugin"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Other users' images in uploads get deleted by a subscriber","analyst_note":"Confirm the fixed version of the Motors plugin after 1.4.128 from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116617.","how_to_check":"- Check the installed version of the Motors plugin in the WordPress admin plugins list; versions up to and including `1.4.128` are affected.\n- Look for the `stm_save_user_extra_fields` function and the `stm_dealer_logo_path` user meta key in the plugin code.\n- Confirm whether user registration lets new accounts sign up as Subscriber.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version","registration-closed"],"who_is_affected":"Sites running the Motors car dealership and classified listings plugin for WordPress at version 1.4.128 or earlier are exposed. The attacker needs a Subscriber-level account on the site, which open registration can provide, and the flaw lets them delete image files of other users in the uploads folder. Sites without this plugin, or with it at a later version, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00081,"input_tokens":4552,"output_tokens":709,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116617':13A,16A '-2026':12A,15A '/uploads':55B,195C '1.4.128':103C 'access':180C 'accord':77B 'allow':244C 'attack':121C,175C,250C 'attacker-control':120C 'authent':174C 'author':226C 'avatar':62B,199C 'basedir':263C 'becom':221C 'become-deal':220C 'belong':57B,187C 'bind':136C 'cannot':74B,275C 'capabl':167C 'car':27B,83C 'check':135C,168C 'classifi':85C 'content':54B,194C 'control':122C 'craft':40B,208C 'cve':11A,14A 'dealer':64B,124C,200C,222C 'dealership':28B,84C 'delet':6A,48B,95C,184C 'descript':80B 'direct':128C 'directori':70B,267C 'edit':165C 'exist':106C 'extens':257C 'extra':111C 'field':112C,154C,156C 'file':41B,50B,66B,94C,186C,246C,253C,264C,274C 'form':223C 'gate':159C 'guard':233C 'hash':153C 'hook':113C 'imag':10A,49B,185C,245C,256C 'includ':61B,102C,196C 'let':32B 'level':179C 'list':86C 'log':35B 'logged-in':34B 'logo':65B,125C,201C 'lost':151C 'make':170C 'manag':162C 'media':204C 'meta':131C 'motor':2A,18B,26B,82C 'motors-plugin':17B 'mvl':235C,242C 'note':228C 'option':116C,163C 'outsid':67B,265C 'ownership':134C 'packag':20B 'page':227C 'paramet':127C 'password':152C 'path':42B,126C,139C,209C,232C,237C 'payment':147C 'person':115C 'php':273C 'plugin':3A,19B,24B,29B,87C,88C,272C 'possibl':172C 'profil':45B,213C 'reach':76B,277C 'resolv':259C 'restrict':248C 'save':109C 'status':148C 'stm':108C,123C,146C,150C,234C,241C 'store':38B,206C 'submit':138C,142C 'subscrib':4A,37B,178C 'subscriber-level':177C 'surfac':251C 'trigger':216C 'two':231C 'unlik':144C 'unlink':217C 'updat':117C 'upload':9A,69B,203C,239C,262C 'user':8A,60B,110C,130C,143C,166C,190C,198C 'version':98C 'via':210C 'vulner':92C,105C 'within':238C,260C 'without':132C 'wordpress':1A,21B,23B,31B,90C 'wordpress-plugin':22B 'wp':53B,193C 'wp-config.php':73B,270C 'wp-content':52B,192C 'write':118C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Motors car dealership and classified listings plugin for WordPress at version 1.4.128 or earlier are exposed. The attacker needs a Subscriber-level account on the site, which open registration can provide, and the flaw lets them delete image files of other users in the uploads folder. Sites without this plugin, or with it at a later version, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","motorsplugin","package","wordpress","wordpressplugin"],"campaign_type":null,"first_public_at":"2026-11-05T05:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116617","severity":null,"published_at":"2026-11-05T05:18:19+00:00","modified_at":"2026-11-05T05:18:19+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","fetched_at":"2026-11-05T05:31:54+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}