CVE-2026-12435

Name of the Vulnerable Software and Affected Versions Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.112

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can mark or unmark any other user's car listing as sold. This is achieved by replaying a valid nonce—a unique token used to prevent replay attacks—harvested from their own listing against an arbitrary victim post ID. This action triggers a site-wide Sold badge on the victim's listing and removes its special car featured post meta. To exploit this, the attacker must have their own active listing to obtain a valid nonce for the stm mark as sold car action.

Recommendations Update to a version newer than 1.4.111.