CVE-2026-16750— Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
Quick assessment
Affected
stylemix Motors – Car Dealership & Classified Listings Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件“The Motors – Car Dealership & Classified Listings”在 1.4.120 及之前版本中，由于 函数中缺少授权检查，导致存在未授权数据访问漏洞。这使得未经身份验证的攻击者能够获取任意用户的草稿、待发布、私有以及未来日期的汽车列表数据。
Possible ATT&CK Techniques 1 AI
T1566 · Phishing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16750
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
Source: CVE Program / CVE List V5
Vulnerability Description
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| stylemix | Motors – Car Dealership & Classified Listings Plugin | 0 ~ 1.4.120 | - |
|
II. Public POCs for CVE-2026-16750
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16750
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-16750 (1)
Vendor Pages for CVE-2026-16750 (1)
IV. Related Vulnerabilities
Same product: Motors – Car Dealership & Classified Listings Plugin
-
CVE-2026-13114
Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Script -
CVE-2026-12435
Motors <= 1.4.111 - Missing Authorization to Authenticated ( -
CVE-2026-3892
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Auth -
CVE-2026-1934
Motors – Car Dealership & Classified Listings Plugin <= 1.4. -
CVE-2025-10494
Motors – Car Dealership & Classified Listings Plugin <= 1.4.
Same vendor: stylemix
-
CVE-2026-19802
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Mi -
CVE-2026-78284
WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File -
CVE-2026-73404
WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access C -
CVE-2026-68568
WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escal -
CVE-2026-66693
WordPress Motors plugin <= 1.4.113 - Broken Access Control v
Same weakness: CWE-862
-
CVE-2026-54643
CubeCart: Missing Authorization Check for Order Note Deletio -
CVE-2026-54648
CubeCart: Missing Authorization Check in customers.gdpr.inc. -
CVE-2026-54519
AI Agent Automation: Missing ownership checks in memory APIs -
CVE-2026-16582
Booking for Appointments and Events Calendar - Amelia <= 2.4 -
CVE-2026-14311
Booking for Appointments and Events Calendar – Amelia (Premi
V. Comments for CVE-2026-16750
No comments yet