PT-2025-15413 · WordPress · Motors – Car Dealership & Classified Listings Plugin

Michael Mazzolini · Published 2025-04-08 · Updated 2025-08-08 · CVE-2025-2807

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Motors – Car Dealership & Classified Listings Plugin versions 1.4.64 and earlier

Description: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl setup wizard install plugin() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins on the affected site's server, which may make remote code execution possible.

Recommendations: For Motors – Car Dealership & Classified Listings Plugin versions 1.4.64 and earlier, consider disabling the mvl setup wizard install plugin() function until a patch is available to prevent arbitrary plugin installations. Restrict access to the plugin installation feature to minimize the risk of exploitation. Avoid using the plugin's installation functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-2807

Affected Products

Motors – Car Dealership & Classified Listings Plugin

References · 15

• https://plugins.trac.wordpress.org/changeset/3262748/motors-car-dealership-classified-listings/trunk/includes/admin/setup-wizard/includes/ajax_actions.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-2807 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2807 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1909673837035245773 · Twitter Post
• https://t.me/cvetracker/21120 · Telegram Post
• https://twitter.com/cybercronai/status/1909599781082530098 · Twitter Post
• https://t.me/cveNotify/131513 · Telegram Post
• https://twitter.com/vulns_space/status/1909562893936308362 · Twitter Post
• https://twitter.com/CVEnew/status/1909544295289286914 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/733f7666-468a-455c-a953-3d8946940f13?source=cve · Note
• https://t.me/cvedetector/22437 · Telegram Post
• https://t.me/cvenotify/118169 · Telegram Post
• https://twitter.com/cybercronai/status/1909629993744806101 · Twitter Post
• https://twitter.com/cybercronai/status/1909599779421634783 · Twitter Post
• https://twitter.com/CveFindCom/status/1909547161148080635 · Twitter Post