{"id":"CVE-2026-123468","kind":"vulnerability","aliases":["CVE-2026-123468"],"related":[],"title":"WordPress Motors car dealership plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.","summary":"The Motors car dealership classified listings WordPress plugin by StylemixThemes has a missing authorization check, so access control is not enforced on some actions. The sources do not say what data or actions an attacker gains beyond that.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["motors-plugin","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Motors - Car Dealership & Classified Listings plugin in the WordPress admin plugin list, or look for the plugin directory `wp-content/plugins/motors-car-dealership-classified-listings`\n- Compare the installed version against `1.4.128`; versions through `1.4.128` are listed as affected","fix":"- Move the Motors plugin to a version later than `1.4.128`; the sources do not name the exact fixed version","status":"open","published_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:35+00:00","updated_at":"2026-11-07T11:48:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Motors plugin to a version later than `1.4.128`; the sources do not name the exact fixed version","reach":"internet","title":"WordPress Motors car dealership plugin: missing authorization check exposes access control","impact":"medium","summary":"The Motors car dealership classified listings WordPress plugin by StylemixThemes has a missing authorization check, so access control is not enforced on some actions. The sources do not say what data or actions an attacker gains beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","motors-plugin","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may perform actions reserved for privileged roles","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the exact vulnerable action and required role.","how_to_check":"- Check the installed version of the Motors - Car Dealership & Classified Listings plugin in the WordPress admin plugin list, or look for the plugin directory `wp-content/plugins/motors-car-dealership-classified-listings`\n- Compare the installed version against `1.4.128`; versions through `1.4.128` are listed as affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Motors car dealership classified listings WordPress plugin at version 1.4.128 or earlier are in scope. The sources do not describe the exact configuration or role needed, so it is unknown whether anonymous visitors can trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4212,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123468':14A,17A '-2026':13A,16A '1.4.128':89C 'access':10A,42B,79C 'action':49B,58B 'affect':84C 'allow':75C 'attack':60B 'author':7A,39B,64C 'beyond':62B 'car':3A,28B,71C 'check':8A,40B 'classifi':30B,73C 'configur':78C 'control':11A,43B,80C 'cve':12A,15A 'data':56B 'dealership':4A,29B,72C 'enforc':46B 'exploit':76C 'expos':9A 'gain':61B 'host':24B 'incorrect':77C 'issu':83C 'levels.this':82C 'list':31B,74C 'miss':6A,38B,63C 'motor':2A,19B,27B,68C,70C,85C 'motors-car-dealership-classified-list':69C 'motors-plugin':18B 'n/a':87C 'packag':21B 'plugin':5A,20B,33B 'say':54B 'secur':81C 'self':23B 'self-host':22B 'sourc':51B 'stylemixthem':35B,67C 'vulner':65C 'wordpress':1A,25B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Motors car dealership classified listings WordPress plugin at version 1.4.128 or earlier are in scope. The sources do not describe the exact configuration or role needed, so it is unknown whether anonymous visitors can trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","motorsplugin","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123468':14A,17A '-2026':13A,16A 'access':10A 'author':7A 'car':3A 'check':8A 'control':11A 'cve':12A,15A 'dealership':4A 'expos':9A 'miss':6A 'motor':2A 'plugin':5A 'wordpress':1A","search_b":"'access':42B 'action':49B,58B 'attack':60B 'author':39B 'beyond':62B 'car':28B 'check':40B 'classifi':30B 'control':43B 'data':56B 'dealership':29B 'enforc':46B 'gain':61B 'host':24B 'list':31B 'miss':38B 'motor':19B,27B 'motors-plugin':18B 'packag':21B 'plugin':20B,33B 'say':54B 'self':23B 'self-host':22B 'sourc':51B 'stylemixthem':35B 'wordpress':25B,32B","search_c":"'1.4.128':89C 'access':79C 'affect':84C 'allow':75C 'author':64C 'car':71C 'classifi':73C 'configur':78C 'control':80C 'dealership':72C 'exploit':76C 'incorrect':77C 'issu':83C 'levels.this':82C 'list':74C 'miss':63C 'motor':68C,70C,85C 'motors-car-dealership-classified-list':69C 'n/a':87C 'secur':81C 'stylemixthem':67C 'vulner':65C","first_public_at":"2026-11-07T11:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123468","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123468","severity":null,"published_at":"2026-11-07T11:17:00+00:00","modified_at":"2026-11-07T11:17:01+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}