WordPress Plugin Vulnerabilities

Motors < 1.4.81 - Unauthenticated Insecure Direct Object Reference

Description

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.80 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
motors-car-dealership-classified-listings
Fixed in 1.4.81

References

CVE
CVE-2025-54691
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f693b48b-9b16-44cc-aded-ded979a3541c

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Bao
Verified
No
WPVDB ID
ad47d571-16c3-4a8e-96f6-d5af8f6d3247

Timeline

Publicly Published
2025-07-30 (about 9 months ago)
Added
2025-08-04 (about 9 months ago)
Last Updated
2025-08-04 (about 9 months ago)

Other

Published
Title
Published
2025-10-08
Title
Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme < 1.5.0 - Authenticated (Subscriber+) Privilege Escalation
Published
2025-02-11
Title
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin < 1.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-01-02
Title
Justicia <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-11-18
Title
Eagle Booking <= 1.3.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-07-21
Title
WP JobHunt <= 7.2 - Subscriber+ Arbitrary Account Deletion via IDOR