Payment Bypass Vulnerability in Motors Car Dealership Plugin for WordPress

CVE-2026-1934

What is CVE-2026-1934?

The Motors – Car Dealership & Classified Listings plugin for WordPress has a vulnerability that allows authenticated users to bypass payment verification. This occurs through the stm_save_user_extra_fields() function, which updates sensitive user meta fields based on POST data without sufficient permission checks. Any authenticated user, such as those with Subscriber-level access, can manipulate their payment status to 'completed'. This exploitation grants access to paid features without completing the necessary transaction process.

References