Motors exposes non-public vehicle listings without authentication
Motors – Car Dealership & Classified Listings Plugin through 1.4.120 lacks authorization checks in mvl_ajax_dealer_load_cars(). An unauthenticated caller can cause this handler to return draft, pending, private and future car listings belonging to arbitrary users. Attacker-directed listing retrieval therefore crosses the publication-status and owner boundaries that should protect non-public content. The export does not name the request action, parameter used to select a user, or complete returned fields. It establishes disclosure of unpublished listings, not modification of those listings or arbitrary database access.
- Component
- Motors – Car Dealership & Classified Listings Plugin
- Plugin slug
motors-car-dealership-classified-listings- Affected
- <= 1.4.120
- Safe version
- See mitigation notes
- Published
- Sep 17, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 17, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
This archive could not verify a fixed version from the official author release notes reviewed on 2026-10-13. Disable the affected feature or component where practical until remediation for the deployed configuration is established. Until confirmed, disable the exposed dealer-listing functionality or the plugin if it cannot be restricted. The application-level repair should return only published listings to anonymous callers and require both a suitable capability and object-level authorization before returning another user's non-public listings. Official author release notes: https://wordpress.org/plugins/motors-car-dealership-classified-listings/.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N