Motors – Car Dealer, Classifieds & Listing, CVE-2026-16750
- CVE, Research URL
- Application
- Published on
- Sep 18, 2026
- Research Description
- The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.
- Affected versions
-
max 1.4.121.
- Status
-
vulnerable