Vulnerability · Published Sep 17, 2026 · Assigned by WPScan

CVE-2026-91016Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in Motors from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 74.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Motors	0 – before 1.4.121

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/790e62ae-297b-4fcd-9650-b3b99a417713/ exploit, vdb-entry, technical-description