Motors car dealership WordPress plugin file deletion flaw
Members of a car sales website can delete other people's photo files.
Summary
A missing path check in this WordPress car dealership plugin lets logged-in users with Subscriber-level access or higher delete other users' uploaded image files. All versions up to and including 1.4.128 are affected.
Affected when
- Logged-in account with Subscriber-level access or higher
- Motors plugin 1.4.128 or earlier
What to do
No fixed version is named in the sources. Check that the plugin is newer than 1.4.128 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen