Arbitrary File Deletion Vulnerability in Motors – Car Dealership & Classified Listings Plugin for WordPress

CVE-2026-104746

What is CVE-2026-104746?

The Motors – Car Dealership & Classified Listings Plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level access and above to delete arbitrary files on the server. This is due to inadequate file path validation in the stm_listings_ajax_save_user_data function. Attackers can exploit this flaw to alter or remove critical files from the server, potentially leading to remote code execution if sensitive files are deleted. It is important to note that while the deletion is limited to the wp-content/uploads directory, the vulnerability is easily exploitable as the necessary AJAX nonce is visible on all front-end pages, granting any authenticated Subscriber user the ability to modify their own account metadata.

References