Executive brief
The Motors WordPress plugin, used by car dealerships to manage classified vehicle listings, fails to verify user authorization before exposing draft, pending, and private listings. An attacker can view any seller's confidential car listings—including prices, photos, and notes—by simply providing a user ID, without requiring authentication or special permissions.
Technical details
The plugin implements an Insecure Direct Object Reference (IDOR) vulnerability in its listing retrieval logic. The flaw lies in the absence of authorization checks before returning non-published listings; an unauthenticated attacker can enumerate user IDs and access draft, pending, and private car listings by supplying only the numeric user ID as a request parameter. No authentication, special roles, or user interaction is required—only network access to the affected WordPress site. An attacker can retrieve sensitive data including listing titles, prices, media URLs, and seller notes. The vulnerability was fixed in version 1.4.121.
Affected products
- The Motors Motors before 1.4.121
Timeline
- 2026-09-15: disclosed
- 2026-09-17: patched: Version 1.4.121 released