PT-2026-39982 · Stylemix · Motors – Car Dealership & Classified Listings Plugin
Shrikant Bhosale
·
Published
2026-05-12
·
Updated
2026-05-12
·
CVE-2026-1934
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Payment Bypass via insecure user meta update in all versions up to, and including, 1.4.103 This is due to the stm save user extra fields() function updating sensitive user meta fields from POST data without verifying that the current user should have permission to modify those fields. The function hooks into the 'personal options update' action and only checks current user can('edit user', $user id), which passes for any user editing their own profile. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set their stm payment status to 'completed', bypassing the PayPal payment verification and gaining access to paid Dealer membership features without completing any transaction.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Motors – Car Dealership & Classified Listings Plugin