PT-2025-41219 · WordPress · Motors – Car Dealership & Classified Listings Plugin

Kishan Vyas · Published 2025-10-08 · Updated 2025-10-13 · CVE-2025-10494

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.89

Description The software is susceptible to arbitrary file deletion because of inadequate file path validation when deleting profile pictures. An authenticated attacker with Subscriber-level access or higher can delete arbitrary files on the server. Deleting specific files, such as wp-config.php, could lead to remote code execution.

Recommendations Update The Motors – Car Dealership & Classified Listings Plugin to version 1.4.89 or later.

Fix

RCE

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-10494

Affected Products

Motors – Car Dealership & Classified Listings Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-10494 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3369415%40motors-car-dealership-classified-listings%2Ftrunk&old=3367132%40motors-car-dealership-classified-listings%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1975769999223456119 · Twitter Post
• https://twitter.com/MNovofastovsky/status/1976584442090320209 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e6066890-75b9-468d-9f67-78e93f58dcc1?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1975900780839272599 · Twitter Post
• https://twitter.com/cracbot/status/1977690831319380079 · Twitter Post
• https://t.me/CVEtracker/34404 · Telegram Post
• https://t.me/cveNotify/137757 · Telegram Post