Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.1
CVE-2026-91023: Motors plugin lets low‑level users change other listings
CVE-2026-91023 · published 17 days ago
Summary
The Motors add‑on for WordPress (versions earlier than 1.4.124) does not check that a user is allowed to edit a specific listing. A user with a basic subscriber account can alter the details of listings they don’t own, including changing product prices, but only when WooCommerce is running and the paid featured‑listing option is turned on. Update the Motors plugin to the latest version or turn off the featured‑listing feature until you can upgrade.
What to do
- Update unknown motors to version 1.4.124 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | motors | < 1.4.124 |
Original advisory text
Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.1
Low
Type
CWE-862Missing Authorization
Timeline
Published2 Oct 2026
Updated8 Oct 2026
First seen2 Oct 2026
Track software like this
Free during beta