Arbitrary File Deletion in Motors – Car Dealership & Classified Listings WordPress Plugin

Executive Summary

This WordPress plugin vulnerability allows authenticated attackers with subscriber-level access to delete arbitrary files due to insufficient file path validation in the stm_listings_ajax_save_user_data function. The flaw exists in versions up to 1.4.125 and can lead to remote code execution if critical files like wp-config.php are deleted.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file deletions in wp-content/uploads by reviewing server logs for suspicious activity. Look for requests to the stm_listings_ajax_save_user_data function or unusual AJAX calls from subscriber-level users.

Useful 0 Not Useful 0

Impact Analysis

An attacker could delete important files on your server, potentially causing website crashes, data loss, or enabling further attacks like remote code execution. Even with uploads directory restrictions, attackers can still cause significant damage by deleting user-uploaded files or configuration data.

Useful 0 Not Useful 0

Mitigation Strategies

• Update the Motors – Car Dealership & Classified Listings Plugin to the latest version if available.
• Restrict file deletion permissions by modifying server configurations to limit write access for subscriber accounts.
• Monitor wp-content/uploads for unauthorized file changes or deletions.
• Consider temporarily disabling the plugin until a patch is applied.

Useful 0 Not Useful 0