WordPress security changelog
MEDIUM CVE-2026-7859 Deferred

Motors: Cross-site request forgery

Motors is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is < 1.4.110.

CVE / CNA score 5.3 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
Motors
Plugin slug
motors
Affected
< 1.4.110
Safe version
1.4.110
Published
Jun 22, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Jun 22, 2026 and is one of 4 known issues for this theme.

What to do

Patch or disable the affected component.

Update Motors to 1.4.110 or later, or disable and remove it until a fixed version is available.

Source record

Technical description

The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary post metadata, such as the gallery, featured image and, on WooCommerce sites, product prices.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources