CVE-2026-16750

MEDIUM 5.3

Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.

CWE	CWE-862
Vendor	stylemix
Product	motors – car dealership & classified listings plugin
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for stylemix motors – car dealership & classified listings plugin

Be the first to know when new medium vulnerabilities affecting stylemix motors – car dealership & classified listings plugin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

stylemix / Motors – Car Dealership & Classified Listings Plugin

0 ≤ 1.4.120

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/38d01b12-97ac-412b-b9df-c27118ce8f50?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3684170/

Credits

Niv Kochan Matan Bahar