{"id":"CVE-2026-123467","kind":"vulnerability","aliases":["CVE-2026-123467"],"related":[],"title":"WordPress Motors car dealership plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.","summary":"The Motors car dealership classified listings WordPress plugin lacks an authorization check on some functionality, so access controls are not enforced as intended. An attacker may be able to perform actions or reach data that should be restricted to other users.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["motors-plugin","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `motors-car-dealership-classified-listings` plugin is installed on the WordPress site, in the plugins list or the `wp-content/plugins/` directory.\n- Compare the installed plugin version against the affected range (through `1.4.128`).","fix":null,"status":"open","published_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:35+00:00","updated_at":"2026-11-07T13:49:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T13:49:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Motors car dealership plugin: missing authorization check exposes access controls","impact":"medium","summary":"The Motors car dealership classified listings WordPress plugin lacks an authorization check on some functionality, so access controls are not enforced as intended. An attacker may be able to perform actions or reach data that should be restricted to other users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","motors-plugin","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted plugin functions and data","analyst_note":"Confirm the fixed version and the vulnerable endpoint or role from the Wordfence or NVD entry for CVE-2026-123467.","how_to_check":"- Check whether the `motors-car-dealership-classified-listings` plugin is installed on the WordPress site, in the plugins list or the `wp-content/plugins/` directory.\n- Compare the installed plugin version against the affected range (through `1.4.128`).","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Motors car dealership classified listings WordPress plugin at version 1.4.128 or earlier are in scope. The sources do not say which roles or configurations are needed to exploit it, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4212,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123467':14A,17A '-2026':13A,16A '1.4.128':93C 'abl':53B 'access':10A,42B,83C 'action':56B 'affect':88C 'allow':79C 'attack':50B 'author':7A,36B,68C 'car':3A,28B,75C 'check':8A,37B 'classifi':30B,77C 'configur':82C 'control':11A,43B,84C 'cve':12A,15A 'data':59B 'dealership':4A,29B,76C 'enforc':46B 'exploit':80C 'expos':9A 'function':40B 'host':24B 'incorrect':81C 'intend':48B 'issu':87C 'lack':34B 'levels.this':86C 'list':31B,78C 'may':51B 'miss':6A,67C 'motor':2A,19B,27B,72C,74C,89C 'motors-car-dealership-classified-list':73C 'motors-plugin':18B 'n/a':91C 'packag':21B 'perform':55B 'plugin':5A,20B,33B 'reach':58B 'restrict':63B 'secur':85C 'self':23B 'self-host':22B 'stylemixthem':71C 'user':66B 'vulner':69C 'wordpress':1A,25B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Motors car dealership classified listings WordPress plugin at version 1.4.128 or earlier are in scope. The sources do not say which roles or configurations are needed to exploit it, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","motorsplugin","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123467':14A,17A '-2026':13A,16A 'access':10A 'author':7A 'car':3A 'check':8A 'control':11A 'cve':12A,15A 'dealership':4A 'expos':9A 'miss':6A 'motor':2A 'plugin':5A 'wordpress':1A","search_b":"'abl':53B 'access':42B 'action':56B 'attack':50B 'author':36B 'car':28B 'check':37B 'classifi':30B 'control':43B 'data':59B 'dealership':29B 'enforc':46B 'function':40B 'host':24B 'intend':48B 'lack':34B 'list':31B 'may':51B 'motor':19B,27B 'motors-plugin':18B 'packag':21B 'perform':55B 'plugin':20B,33B 'reach':58B 'restrict':63B 'self':23B 'self-host':22B 'user':66B 'wordpress':25B,32B","search_c":"'1.4.128':93C 'access':83C 'affect':88C 'allow':79C 'author':68C 'car':75C 'classifi':77C 'configur':82C 'control':84C 'dealership':76C 'exploit':80C 'incorrect':81C 'issu':87C 'levels.this':86C 'list':78C 'miss':67C 'motor':72C,74C,89C 'motors-car-dealership-classified-list':73C 'n/a':91C 'secur':85C 'stylemixthem':71C 'vulner':69C","first_public_at":"2026-11-07T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123467","severity":null,"published_at":"2026-11-07T13:16:37+00:00","modified_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}