CVE-2026-116617 in Motors Plugin
Summary
by MITRE • 11/05/2026
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under `wp-content/uploads` — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering `unlink()` through the become-dealer form on their author page. Note that the two path guards (`stm_mvl_is_path_within_uploads` and `stm_mvl_is_allowed_image_file`) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as `wp-config.php` or plugin PHP files, cannot be reached.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The Motors – Car Dealership & Classified Listings Plugin for WordPress contains a critical file deletion vulnerability affecting all versions up to and including 1.4.128. This flaw stems from an improper implementation of access controls within the user profile update mechanism. Specifically, the function stm_save_user_extra_fields is hooked to the personal_options_update action, which triggers whenever a user updates their own profile information. Within this process, the plugin writes the attacker-controlled parameter stm_dealer_logo_path directly into the WordPress user meta data without performing an ownership check that binds the submitted path value strictly to the submitting user's identity or authorized scope. This lack of validation stands in stark contrast to other fields handled by similar functions, such as stm_payment_status and stm_lost_password_hash, which are properly gated by high-level capability checks like manage_options or edit_users. The absence of such restrictive permissions for the logo path field allows any authenticated user with Subscriber-level access or higher to manipulate this parameter freely.
The operational impact of this vulnerability is significant, enabling authenticated attackers to delete arbitrary image files belonging to other users within the WordPress uploads directory structure. By crafting a malicious value for the stm_dealer_logo_path and submitting it through their own profile update form, an attacker can store a path that points to resources owned by different user accounts. Subsequently, when the victim or another authorized party interacts with the become-dealer form on the affected author page, the system triggers an unlink operation using the previously stored malicious path. This results in the permanent deletion of critical media assets, including avatars, dealer logos, and other uploaded images located under wp-content/uploads. The attack does not require privilege escalation beyond standard authenticated access, making it a low-barrier threat for any registered user on the platform.
From a technical perspective, this vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-732: Incorrect Permission Assignment for Critical Resource. The core issue lies in the failure to validate that the resource being modified or deleted belongs to the actor initiating the action. While the plugin includes two path guards, stm_mvl_is_path_within_uploads and stm_mvl_is_allowed_image_file, these controls only restrict the attack surface to files with image extensions that resolve within the uploads base directory. Consequently, while attackers cannot delete sensitive configuration files such as wp-config.php or core PHP plugin files due to these boundary checks, they retain full destructive capability over all user-generated media assets. This limitation aligns partially with ATT&CK technique T1485: Data Destruction, specifically focusing on file deletion within a restricted environment rather than system-wide compromise.
Mitigation strategies must prioritize immediate patching of the plugin to version 1.4.129 or later where this logic error is resolved. In the interim, administrators should enforce strict role-based access controls and consider disabling user profile editing for lower-privileged roles if not strictly necessary. Additionally, implementing server-side validation that verifies file ownership before executing unlink operations would provide a robust defense-in-depth measure. Regular backups of the wp-content/uploads directory are also recommended to ensure rapid recovery from any successful deletion attacks exploiting this flaw until the patch is applied.