CVE-2026-91023
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: WPScan

Description
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-19
AI Q&A
2026-10-02
EPSS Evaluated
2026-10-18
NVD
CVE-2026-91023
EUVD
EUVD-2026-91194

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Motors 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WordPress plugin 'Motors – Car Dealership & Classified Listings' versions before 1.4.124. It allows authenticated users with subscriber-level access or higher to modify post metadata, including overwriting product prices, on listings they do not own due to improper authorization checks before processing listing management actions.

Detection Guidance

Check the installed version of the Motors WordPress plugin. If it is below 1.4.124, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep motors. Exploitation may involve unauthorized metadata changes, so review post metadata for unexpected modifications.

Impact Analysis

An attacker could change product prices on listings they do not own, potentially leading to financial losses or fraud. This requires WooCommerce to be active and the plugin's paid featured-listing option enabled, which are not default settings.

Compliance Impact

This vulnerability allows unauthorized users to modify product prices and metadata on listings they do not own, which could lead to financial discrepancies or fraudulent transactions. While not directly violating GDPR or HIPAA, such unauthorized modifications could compromise data integrity and user trust, potentially violating principles of data accuracy (GDPR Article 5) or integrity and confidentiality (HIPAA Security Rule).

Mitigation Strategies

Update the Motors WordPress plugin to version 1.4.124 or later immediately. Disable the paid featured-listing option if not required. Ensure WooCommerce is updated to the latest secure version. Monitor post metadata for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91023. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart