CVE-2026-91016 in Motors Plugin
Summary
by MITRE • 09/17/2026
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in Motors WordPress plugin versions prior to 1.4.121 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw allows unauthenticated attackers to bypass security checks and access sensitive data associated with user accounts that should remain private or restricted. The core technical issue lies in the application's handling of requests for car listings. When an API endpoint is queried to retrieve listing details based on a numeric user ID, the backend logic fails to verify whether the requesting entity possesses the necessary permissions to view non-published content such as drafts, pending reviews, and private listings. This oversight means that any individual with knowledge or ability to enumerate valid user IDs can exploit this gap without needing valid credentials or session tokens.
From an operational perspective, the impact of this vulnerability is significant for both end-users and site administrators. Attackers can retrieve a comprehensive set of data points including listing titles, pricing information, media URLs containing images or videos, and crucially, seller notes which may contain personal contact details or internal business logic. The exposure of private listings undermines user trust in the platform's security posture, while the leakage of draft content could reveal strategic plans for future sales or inventory management. Furthermore, because the attack requires only a numeric identifier, it is highly automatable and scalable, allowing threat actors to scrape large volumes of data across multiple users with minimal effort. This aligns with ATT&CK technique T1078, Valid Accounts, although in this case, no valid account credentials are strictly required for the attacker, highlighting a severe deficiency in identity verification processes.
The exploitation vector relies on the predictable nature of numeric user IDs often used in WordPress installations. By iterating through sequential or known ID ranges, an adversary can systematically harvest data from multiple users. The inclusion of media URLs poses additional risks as these links may be direct and unauthenticated, potentially allowing for further reconnaissance or even bandwidth exhaustion attacks if not properly rate-limited on the server side. Additionally, seller notes often contain personally identifiable information such as phone numbers or email addresses, which increases the severity due to potential violations of data protection regulations like GDPR or CCPA when exposed without consent.
To mitigate this vulnerability, immediate action is required by updating the Motors WordPress plugin to version 1.4.121 or later where these authorization checks have been implemented. For organizations unable to patch immediately, implementing a Web Application Firewall rule that restricts access to specific API endpoints based on valid session cookies can provide temporary relief. It is also advisable to review server-side logging for unusual patterns of requests targeting user-specific listing endpoints with sequential IDs. Long-term remediation should involve adopting a principle of least privilege in all API designs and ensuring that every data retrieval operation explicitly validates the relationship between the requester's identity and the requested resource, thereby preventing unauthorized access regardless of whether the attacker possesses valid credentials or not.