File Deletion Vulnerability in Motors Car Dealership Plugin for WordPress

CVE-2026-116617

What is CVE-2026-116617?

The Motors – Car Dealership & Classified Listings Plugin is susceptible to a file deletion vulnerability that affects all versions up to 1.4.128. The flaw arises from improper handling of user meta updates in the stm_save_user_extra_fields() function. An authenticated attacker with Subscriber-level permissions can manipulate the stm_dealer_logo_path parameter without adequate checks, enabling them to delete media files belonging to other users stored in the wp-content/uploads directory. This vulnerability is critical for maintaining user privacy and data integrity, as it allows malicious actors to remove essential assets like avatars and dealer logos.

References