Arbitrary File Deletion in Motors Plugin for WordPress

CVE-2025-10494

What is CVE-2025-10494?

The Motors – Car Dealership & Classified Listings Plugin for WordPress has a vulnerability that allows authenticated users, starting from Subscriber-level access, to exploit insufficient file path validation when deleting profile pictures. This flaw can lead to the deletion of arbitrary files from the server, which poses a significant risk, especially if critical files such as wp-config.php are targeted. Site owners should urgently address this issue by updating to the latest version of the plugin and implementing robust security measures to safeguard their WordPress installations.

References