Unauthenticated Post Metadata Modification in Motors WordPress Plugin

Executive Summary

The vulnerability CVE-2026-7859 affects the Motors WordPress plugin versions before 1.4.110. It occurs because the plugin lacks proper authorization and CSRF (Cross-Site Request Forgery) checks on one of its AJAX actions called stm_ajax_add_a_car_media.

This flaw allows unauthenticated attackers to modify arbitrary post metadata, including gallery images, featured images, and on WooCommerce sites, product prices.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized changes on your WordPress site if you use the Motors plugin below version 1.4.110.

• Attackers can modify gallery images and featured images on your posts.
• On WooCommerce sites configured for pay-per-listing, attackers can alter product prices.

Such unauthorized modifications can affect the integrity and trustworthiness of your website content and e-commerce pricing.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or suspicious AJAX requests to the `stm_ajax_add_a_car_media` endpoint in the Motors WordPress plugin. Since the issue involves missing authorization and CSRF checks, crafted requests targeting this AJAX action may indicate exploitation attempts.

Commands to detect such activity could include inspecting web server logs or using network monitoring tools to filter requests containing `stm_ajax_add_a_car_media`. For example, using grep on Apache or Nginx logs:

• grep 'stm_ajax_add_a_car_media' /var/log/apache2/access.log
• grep 'stm_ajax_add_a_car_media' /var/log/nginx/access.log

Additionally, using tools like Wireshark or tcpdump to capture HTTP traffic and filter for this AJAX action can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Motors WordPress plugin to version 1.4.110 or later, where the vulnerability has been fixed.

Until the update can be applied, consider restricting access to the vulnerable AJAX endpoint by implementing firewall rules or web application firewall (WAF) rules to block unauthenticated requests targeting `stm_ajax_add_a_car_media`.

Also, review and monitor your site for unauthorized changes to post metadata, galleries, featured images, and WooCommerce product prices.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0