CVE-2026-12435: Motors WordPress Plugin Authorization Bypass – Nonce Replay on Car Listings

Technical summary

CVE-2026-12435 is an authorization bypass vulnerability in the Motors plugin (all versions up to 1.4.111) stemming from inadequate action verification in the stm_mark_as_sold_car handler. The plugin relies on nonce validation without confirming that the requester has ownership or edit rights over the target post. An attacker with Subscriber-level access can: (1) create a test car listing via the plugin's add-listing form; (2) extract the stm_mark_as_sold_car nonce from their own listing page's HTML; (3) replay that nonce against any other post ID in a request to mark-as-sold. The nonce itself is valid (it passes validation), but the plugin fails to enforce post-level authorization checks, allowing the nonce to work against arbitrary listings. As a side effect, the special_car meta flag is cleared, removing featured status.

Business impact

For multi-seller automotive platforms, this vulnerability directly damages marketplace integrity and seller trust. Competitors can suppress listings of rival sellers by marking them sold prematurely, reducing visibility and shifting buyer interest. Featured listing benefits can be stripped without recourse. Platforms relying on this plugin may see increased seller complaints, chargebacks from missed sales, negative reviews, and potential regulatory scrutiny if fraud is not quickly addressed. Reputation damage and loss of competitive advantage in the marketplace are key risks.

Affected systems

WordPress installations running the Motors – Car Dealership & Classified Listings Plugin in any version up to and including 1.4.111 are vulnerable. The plugin is likely deployed on multi-seller car classifieds, auction platforms, and dealership networks. Any site allowing Subscriber-level user registration and car listing creation is at risk. There are no version-specific exceptions mentioned; all 1.4.111 and earlier versions contain the flaw.

Exploitability

Exploitability is straightforward: the attack requires no special privilege escalation, zero-day toolkit, or complex social engineering. The only prerequisites are (1) an active user account at Subscriber level or higher, (2) permission to create at least one car listing on the target platform, and (3) the ability to make HTTP requests with a harvested nonce. No clickjacking, admin interaction, or user interaction is required. The attack is repeatable and silent—victims may not notice the status change immediately. Attack complexity is low, making this a practical threat for disgruntled users, competitors, or automated abuse campaigns.

Remediation

Site owners should immediately update the Motors plugin to a patched version above 1.4.111 (verify against the vendor's official release notes). Until patching is possible, temporary mitigations include: (1) restricting Subscriber-level access or disabling the add-listing form for untrusted users; (2) monitoring audit logs for suspicious mark-as-sold activity; (3) implementing a require-confirmation workflow so that listing status changes trigger owner email verification; or (4) temporarily disabling the mark-as-sold feature in the plugin settings if such an option exists. These measures are stopgaps only and do not replace a full patch.

Patch guidance

Check the WordPress plugin repository or the vendor's website for an updated version of Motors above 1.4.111. Apply the patch immediately through the WordPress admin dashboard (Plugins → Updates). If the vendor has published a security advisory with specific version guidance, follow that guidance. After patching, verify that existing listings show correct sold/unsold status and that no listings were fraudulently marked as sold during the exposure window. Test the mark-as-sold action on a test listing to confirm the patch includes proper ownership checks.

Detection guidance

Look for suspicious mark-as-sold requests in access logs or WAF logs targeting wp-admin/admin-ajax.php with the action=stm_mark_as_sold_car parameter. Flag requests where the user ID making the request differs from the post author of the target listing. Query WordPress post meta tables for recently cleared special_car flags on active, user-owned listings. Review activity logs (if the site uses an audit plugin) for mark-as-sold actions by users other than the post author. Monitor seller complaints about unexpected status changes. Implement logging on the nonce validation step to detect reuse patterns.

Why prioritize this

Although the CVSS score of 4.3 (Medium) reflects limited confidentiality and availability impact, the integrity violation is direct and repeatable. Automotive marketplaces depend on listing authenticity and seller control—this vulnerability undermines both. The low attack complexity and low privilege requirement mean even casual attackers can exploit it at scale. For any site monetizing listings through featured status or where reputation is critical, prioritization should exceed the base score. Rapid patch deployment is warranted to maintain user trust and prevent fraud-driven churn.

Risk score, explained

The CVSS 3.1 base score of 4.3 reflects: Network-accessible attack vector, Low attack complexity (no special tools or privilege escalation), Low privilege requirement (Subscriber-level accounts are easy to obtain), no User interaction needed, and Unchanged scope. Integrity is impacted (unauthorized modification of listing status), but Confidentiality and Availability are not. The resulting Medium severity is appropriate for the technical attack profile. However, business context—fraud, marketplace trust, regulatory implications—may elevate risk in your environment above the base score.

Frequently asked questions