# CVE-2026-27433: StylemixThemes Motors broken access control in WordPress theme

Source: https://junglewise.ai/threats/cve-2026-27433-stylemixthemes-motors-broken-access-control-in-wordpress-theme  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-27433 · Severity: medium · CVSS 6.5 · Published 2026-07-02

The Motors theme for WordPress, commonly used for automotive dealership websites, contains a security flaw that allows unauthorized individuals to perform actions they should not have access to. Because this issue does not require a login, an attacker could potentially modify site settings or disrupt website operations. This could lead to unauthorized changes to vehicle listings or temporary service outages, impacting the business's online presence and customer trust.

Technologies: [StylemixThemes Motors](https://junglewise.ai/threats/technologies/motors). Vendors: [StylemixThemes](https://junglewise.ai/threats/vendors/stylemixthemes).

## Quick answers

**Is CVE-2026-27433 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27433 being exploited in the wild.

**How severe is CVE-2026-27433?** Medium severity, with a CVSS score of 6.5, published 2 July 2026.

**Which products and versions are affected?** StylemixThemes Motors <= 5.6.80.

**Is there a fix for CVE-2026-27433?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-27433 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-27433?** Check whether you run StylemixThemes Motors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Motors theme for WordPress (versions up to and including 5.6.80) suffers from a broken access control vulnerability due to missing authorization checks (CWE-862). This flaw allows an unauthenticated remote attacker to execute functions that should be restricted to higher-privileged users. The attack vector is network-based and requires no user interaction or prior authentication. Successful exploitation can lead to unauthorized integrity changes or availability impacts on the affected WordPress site. As of the advisory date, no official patch has been released by the developer.

## Affected products

- StylemixThemes Motors <= 5.6.80

## Timeline

- 2025-10-15: disclosed: Reported by Rafie Muhammad to Patchstack
- 2026-06-30: advisory: Initial advisory published by Patchstack
- 2026-07-02: other: CVE record published and added to NVD dataset

## References

- [https://patchstack.com/database/wordpress/theme/motors/vulnerability/wordpress-motors-theme-5-6-80-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/theme/motors/vulnerability/wordpress-motors-theme-5-6-80-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [StylemixThemes Motors stored cross-site scripting](https://junglewise.ai/threats/cve-2026-66675-improper-neutralization-of-input-during-web-page-generation-cross)
- [StylemixThemes Motors broken access control](https://junglewise.ai/threats/cve-2026-123467-missing-authorization-vulnerability-in-stylemixthemes-motors)
- [StylemixThemes Motors broken access control](https://junglewise.ai/threats/cve-2026-123468-missing-authorization-vulnerability-in-stylemixthemes-motors)
- [StylemixThemes Motors SQL injection in classified listings](https://junglewise.ai/threats/cve-2026-115964-improper-neutralization-of-special-elements-used-in-an-sql)
- [StylemixThemes Motors broken access control in theme](https://junglewise.ai/threats/cve-2026-93950-missing-authorization-vulnerability-in-stylemixthemes-motors)