CVE-2026-3892

Name of the Vulnerable Software and Affected Versions The Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.108

Description Insufficient file path validation in the become-dealer logo upload flow allows authenticated users with subscriber level access and above to delete arbitrary files on the server. This occurs because the profile update handler permits the setting of an arbitrary filesystem path.

Recommendations Update the plugin to a version later than 1.4.107.