Executive brief
The Motors plugin for WordPress, used by car dealerships to manage vehicle listings, contains an authorization bypass vulnerability that allows unauthenticated attackers to view restricted listings including draft, pending, private, and future car listings. This exposes potentially sensitive commercial vehicle inventory and dealer information without requiring valid user credentials.
Technical details
The vulnerability is a missing authorization check in the mvl_ajax_dealer_load_cars() AJAX function, allowing unauthenticated access to restricted car listing data. The AJAX endpoint does not validate user permissions before returning draft, pending, private, and future vehicle listings from arbitrary users. An attacker can make direct AJAX requests to retrieve sensitive listing information without authentication. The vulnerability affects all versions up to and including 1.4.120 of The Motors plugin.
Affected products
- WordPress The Motors – Car Dealership & Classified Listings Plugin up to and including 1.4.120
Timeline
- 2026-09-17: disclosed