Authorization Bypass in Motors WordPress Plugin

Executive Summary

The Motors – Car Dealership & Classified Listings Plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 1.4.111. This occurs because the plugin does not properly verify if a user is authorized to perform certain actions.

An authenticated attacker with subscriber-level access or higher can exploit this by using a valid nonce (a security token) harvested from their own car listing and replaying it against another user's listing. This allows the attacker to mark or unmark any other user's car listing as sold.

As a side effect, the victim's listing will display a site-wide 'Sold' badge and silently lose its special_car featured post meta.

To exploit this, the attacker must have an active listing of their own to obtain the valid nonce.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with subscriber-level access to manipulate other users' car listings by marking or unmarking them as sold without proper authorization.

Such unauthorized changes can lead to misinformation on the site, potentially damaging the reputation of legitimate sellers and causing confusion among buyers.

Additionally, the silent removal of the special_car featured post meta could affect the visibility or prominence of listings, impacting business operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authorization bypass in the Motors – Car Dealership & Classified Listings Plugin for WordPress, allowing authenticated users with subscriber-level access to mark or unmark other users' car listings as sold by replaying a valid nonce. Detection would involve monitoring for unusual or unauthorized 'sold' status changes on car listings, especially those triggered by subscriber-level accounts.

Since exploitation requires replaying a valid nonce for the 'stm_mark_as_sold_car' action, detection could include logging and analyzing requests to this action endpoint for suspicious patterns such as multiple requests from the same user affecting different listings.

Specific commands are not provided in the available resources or CVE description.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting subscriber-level users from adding listings or performing actions that require authorization verification until the plugin is updated.

Another step is to monitor and audit changes to car listings marked as sold, especially those initiated by subscriber-level users, to detect and revert unauthorized changes.

Applying any available updates or patches from the plugin developer that address this authorization bypass vulnerability is recommended once released.

Useful 0 Not Useful 0