Authorization Bypass in Motors Plugin for WordPress

CVE-2026-12435

What is CVE-2026-12435?

The Motors – Car Dealership & Classified Listings Plugin for WordPress has a vulnerability allowing authenticated users, with subscriber-level access or greater, to misuse authorized actions. This occurs due to inadequate verification of user permissions when marking listings as sold. Attackers can exploit this flaw by replaying a valid nonce from their own listings against any other user's post ID, enabling them to falsely alter status and remove special features from victims' listings silently. Affected versions include all releases up to 1.4.111.

References