PT-2026-40884 · WordPress · Motors – Car Dealership & Classified Listings Plugin

Leonid Semenenko · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-3892

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.108

Description Insufficient file path validation in the become-dealer logo upload flow allows authenticated users with subscriber level access and above to delete arbitrary files on the server. This occurs because the profile update handler permits the setting of an arbitrary filesystem path.

Recommendations Update the plugin to a version later than 1.4.107.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-3892

Affected Products

Motors – Car Dealership & Classified Listings Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3892 · Security Note
• https://twitter.com/KaitanSecurity/status/2054826592786887034 · Twitter Post
• https://t.me/cveNotify/163407 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3505874 · Note
• https://twitter.com/VulmonFeeds/status/2054906382529208403 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/52cbc6a4-9825-4b26-8653-0c75cf5247c5?source=cve · Note
• https://t.me/CVEtracker/53755 · Telegram Post