Unauthorized Data Modification Vulnerability in Motors Plugin for WordPress

CVE-2024-13737

Summary

The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is subject to a vulnerability that allows authenticated users with Subscriber-level access or higher to perform unauthorized data modifications. This flaw arises from inadequate capability checks within the motors_create_template and motors_delete_template functions. If exploited, this vulnerability enables attackers to delete any arbitrary posts or create malicious listing templates. The presence of the required Elementor plugin amplifies the potential impact of this issue, which affects all versions of the Motors plugin up to and including version 1.4.57.

References