Is CVE-2026-123467 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123467 being exploited in the wild.

How severe is CVE-2026-123467?

Medium severity, with a CVSS score of 4.3, published 7 November 2026.

Which products and versions are affected?

StylemixThemes Motors through 1.4.128.

Is there a fix for CVE-2026-123467?

Yes: fixed in 1.4.129. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123467 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123467?

Check whether you run StylemixThemes Motors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123467: StylemixThemes Motors broken access control

CVE-2026-123467 · Severity: medium · CVSS 4.3 · Published 2026-11-07

The Motors car dealership classified listings plugin for WordPress allows users to access pages or perform actions they should not be permitted to reach due to misconfigured access controls. An attacker with a subscriber account could view other users' data or perform unauthorized actions on the platform, potentially exposing sensitive customer information or compromising business data.

Technologies: StylemixThemes Motors. Vendors: StylemixThemes.

Quick answers

Is CVE-2026-123467 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123467 being exploited in the wild.
How severe is CVE-2026-123467?: Medium severity, with a CVSS score of 4.3, published 7 November 2026.
Which products and versions are affected?: StylemixThemes Motors through 1.4.128.
Is there a fix for CVE-2026-123467?: Yes: fixed in 1.4.129. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123467 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123467?: Check whether you run StylemixThemes Motors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.4.129

Technical details

A broken access control vulnerability exists in the Motors WordPress plugin where user privilege checks are not properly enforced, allowing subscribers to access functionality or data they lack authorization for. The vulnerability requires an authenticated subscriber-level account to exploit. A fix is available in version 1.4.129 and later.

Affected products

StylemixThemes Motors through 1.4.128

Timeline

2026-11-07: disclosed
2026-11-07: patched: Version 1.4.129 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.