---
id: "CVE-2026-123467"
page: "https://infrastack.ai/live/CVE-2026-123467"
kind: "vulnerability"
aliases: ["CVE-2026-123467"]
title: "WordPress Motors car dealership plugin: missing authorization check exposes access controls"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["motors-plugin", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T13:16:37+00:00"
first_seen_at: "2026-11-07T13:47:26+00:00"
updated_at: "2026-11-07T13:49:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123467", "first_seen_at": "2026-11-07T13:47:26+00:00"}]
exploit_sources: []
---

# WordPress Motors car dealership plugin: missing authorization check exposes access controls

Link for people: https://infrastack.ai/live/CVE-2026-123467 (this .md is for agents)

The Motors car dealership classified listings WordPress plugin lacks an authorization check on some functionality, so access controls are not enforced as intended. An attacker may be able to perform actions or reach data that should be restricted to other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `motors-car-dealership-classified-listings` plugin is installed on the WordPress site, in the plugins list or the `wp-content/plugins/` directory.
- Compare the installed plugin version against the affected range (through `1.4.128`).

## Timeline

- 2026-11-07T13:47:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123467

## From the sources

Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_