CVE-2026-116617

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because stm save user extra fields(), hooked to personal options update, writes the attacker-controlled stm dealer logo path parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the stm payment status and stm lost password hash fields, this field is not gated by a manage options or edit users capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under wp-content/uploads — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering unlink() through the become-dealer form on their author page. Note that the two path guards (stm mvl is path within uploads and stm mvl is allowed image file) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as wp-config.php or plugin PHP files, cannot be reached.