Vulnerability · Published Nov 5, 2026 · Assigned by WPScan
CVE-2026-105971Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax
Unrated
In plain English
A security flaw in Car Dealer (Dealership) and Vehicle sales from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.1%top 96.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Car Dealer (Dealership) and Vehicle sales | 0 – through 4.73 |
References
- https://wpscan.com/vulnerability/fd2f5dbc-3a93-47d0-8941-3147e85d5d16/ exploit, vdb-entry, technical-description