Low severity · published Oct 2, 2026
CVE-2026-91023
Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured
3.1
CVSS
0.1%
EPSS
No
On KEV
Description
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Motors ·
before 1.4.124 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-91023
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-91023
exploit
https://wpscan.com/vulnerability/c2400c65-5d77-454c-9691-5e664556341b/
More from Motors
6.8
CVE-2026-91022
Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color
5.3
CVE-2026-91016
Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
5.3
CVE-2026-7859
Motors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media