Junglewise Threat Intelligence

CVE-2026-1934: StylemixThemes Motors Plugin payment bypass via insecure user meta update

CVE-2026-1934 · Severity: medium · CVSS 4.3 · Published 2026-05-12

Technologies: StylemixThemes Motors – Car Dealership & Classified Listings. Vendors: StylemixThemes.

Executive brief

The Motors plugin for WordPress, used for managing car dealership and classified listing websites, contains a security flaw that allows users to bypass payment requirements. By exploiting this issue, a registered user can falsely mark their payment status as completed without actually paying. This allows unauthorized access to premium Dealer membership features, resulting in lost revenue and unauthorized use of paid services.

Technical details

The vulnerability is classified as a missing authorization check (CWE-862) within the stm_save_user_extra_fields() function. This function, which hooks into the 'personal_options_update' action, fails to properly validate permissions when updating sensitive user meta fields from POST data. It only verifies if the current user has the 'edit_user' capability for the target ID, which is true for any user editing their own profile. An authenticated attacker with Subscriber-level access can exploit this to set their 'stm_payment_status' to 'completed', effectively bypassing PayPal verification and gaining access to paid Dealer features. The issue is addressed in version 1.4.104.

Affected products

  • StylemixThemes Motors – Car Dealership & Classified Listings up to, and including, 1.4.103

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory

References

Related threats