Is CVE-2026-54828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54828 being exploited in the wild.

How severe is CVE-2026-54828?

High severity, with a CVSS score of 7.5, published 25 June 2026.

Is there a fix for CVE-2026-54828?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54828 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54828?

Check whether you run StylemixThemes Motors – Car Dealership & Classified Listings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54828: StylemixThemes Motors broken access control

CVE-2026-54828 · Severity: high · CVSS 7.5 · Published 2026-06-25

The Motors plugin for WordPress, which provides car dealership and classified listing functionality, contains a security flaw that allows unauthorized users to perform actions they should not be able to. An attacker could exploit this to modify site data or settings without needing a password or account. This could lead to unauthorized changes to vehicle listings or site configuration, potentially impacting the integrity of the dealership's online operations.

Technologies: StylemixThemes Motors – Car Dealership & Classified Listings. Vendors: StylemixThemes.

Quick answers

Is CVE-2026-54828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54828 being exploited in the wild.
How severe is CVE-2026-54828?: High severity, with a CVSS score of 7.5, published 25 June 2026.
Which products and versions are affected?: StylemixThemes Motors – Car Dealership & Classified Listings <= 1.4.109.
Is there a fix for CVE-2026-54828?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54828 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54828?: Check whether you run StylemixThemes Motors – Car Dealership & Classified Listings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Motors plugin (motors-car-dealership-classified-listings) for WordPress is vulnerable to broken access control due to missing authorization checks (CWE-862) in versions up to 1.4.109. This allows an unauthenticated remote attacker to execute functions or actions that should be restricted to higher-privileged users. The vulnerability has a CVSS score of 7.5, indicating high integrity impact without direct confidentiality or availability loss. The issue is resolved in version 1.4.110.

Affected products

StylemixThemes Motors - Car Dealership & Classified Listings <= 1.4.109

Timeline

2026-05-07: other: Reported by researcher HaiND
2026-06-17: disclosed: Vulnerability disclosed by Patchstack
2026-06-25: advisory: CVE published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.