PT-2026-94181

CVE-2026-91016

Published

2026-09-17

Updated

2026-09-17

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Motors WordPress plugin versions prior to 1.4.121

Description An authorization bypass exists that allows unauthenticated attackers to access non-published car listings, including those in draft, pending, and private status. By providing a target's numeric user id, an attacker can retrieve sensitive information such as titles, prices, media URLs, and seller notes.

Recommendations Update Motors WordPress plugin to version 1.4.121 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Pedro Pinho

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers