CVE-2026-104746 Details
Description
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler's stm_user_avatar_path meta is writable by any logged-in user against their own account.
A vulnerability allowing arbitrary file deletion has been identified in the Motors – Car Dealership & Classified Listings Plugin for WordPress, affecting all versions through 1.4.125. The issue arises from inadequate file path validation in the 'stm_listings_ajax_save_user_data' function. This vulnerability enables authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. While the deletion is restricted to the 'wp-content/uploads' directory, preventing the removal of critical files like 'wp-config.php', any authenticated subscriber can easily exploit this flaw. The required AJAX nonce is available on every front-end page, and the 'stm_user_avatar_path' meta can be modified by any logged-in user on their own account.
Users are advised to update the Motors – Car Dealership & Classified Listings Plugin to version 1.4.126 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Motors | <= 1.4.125 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 7, 2026 | New CVE Received | [email protected] |