# CVE-2026-12435: Stylemix Motors Plugin authorization bypass in stm_mark_as_sold_car

Source: https://junglewise.ai/threats/cve-2026-12435-stylemix-motors-plugin-authorization-bypass-in-stm-mark-as-sold  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-12435 · Severity: medium · CVSS 4.3 · Published 2026-07-01

The Motors plugin for WordPress, used to manage car dealership and classified listings, contains a security flaw that allows registered users to interfere with other people's listings. An attacker can falsely mark any vehicle on the site as 'Sold' or remove its 'Featured' status. This could disrupt business operations, mislead potential buyers, and damage the reputation of legitimate sellers on the platform.

Technologies: [StylemixThemes Motors – Car Dealership & Classified Listings](https://junglewise.ai/threats/technologies/motors-car-dealership-classified-listings). Vendors: [StylemixThemes](https://junglewise.ai/threats/vendors/stylemixthemes).

## Quick answers

**Is CVE-2026-12435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12435 being exploited in the wild.

**How severe is CVE-2026-12435?** Medium severity, with a CVSS score of 4.3, published 1 July 2026.

**Which products and versions are affected?** StylemixThemes Motors – Car Dealership & Classified Listings up to, and including, 1.4.111.

**Is there a fix for CVE-2026-12435?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12435 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12435?** Check whether you run StylemixThemes Motors – Car Dealership & Classified Listings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Motors plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in the 'stm_mark_as_sold_car' action within the vehicle_functions.php file. Authenticated attackers with Subscriber-level permissions can exploit this by harvesting a valid security nonce from their own active listing and replaying it against an arbitrary victim's post ID. Successful exploitation allows the attacker to trigger a site-wide 'Sold' badge on the victim's listing and silently strip the 'special_car' featured post meta. The vulnerability exists in all versions up to and including 1.4.111.

## Affected products

- StylemixThemes Motors – Car Dealership & Classified Listings Plugin up to, and including, 1.4.111

## Timeline

- 2026-07-01: advisory
- 2026-07-01: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.108/includes/vehicle_functions.php](https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.108/includes/vehicle_functions.php)
- [https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.108/includes/vehicle_functions.php](https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.108/includes/vehicle_functions.php)
- [https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.108/templates/listing-cars/listing-list-owner-actions.php](https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.108/templates/listing-cars/listing-list-owner-actions.php)
- [https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.110/includes/vehicle_functions.php](https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.110/includes/vehicle_functions.php)
- [https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.110/includes/vehicle_functions.php](https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.110/includes/vehicle_functions.php)
- [https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.110/templates/listing-cars/listing-list-owner-actions.php](https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.110/templates/listing-cars/listing-list-owner-actions.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3577332%40motors-car-dealership-classified-listings&new=3577332%40motors-car-dealership-classified-listings&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3577332%40motors-car-dealership-classified-listings&new=3577332%40motors-car-dealership-classified-listings&sfp_email=&sfph_mail=)

## Related threats

- [Stylemix Motors Car Dealership Stored XSS in Comment Content](https://junglewise.ai/threats/cve-2026-13114-stylemix-motors-car-dealership-stored-xss-in-comment-content)
- [StylemixThemes Motors broken access control](https://junglewise.ai/threats/cve-2026-54828-stylemixthemes-motors-broken-access-control)
- [StylemixThemes Motors WordPress plugin unauthorized metadata modification](https://junglewise.ai/threats/cve-2026-7859-stylemixthemes-motors-wordpress-plugin-unauthorized-metadata)
- [StylemixThemes Motors Blind SQL injection](https://junglewise.ai/threats/cve-2026-54812-stylemixthemes-motors-blind-sql-injection)
- [StylemixThemes Motors Local File Inclusion in WordPress plugin](https://junglewise.ai/threats/cve-2026-54814-stylemixthemes-motors-local-file-inclusion-in-wordpress-plugin)