CVE-2026-16750CWE-862broken-access-control

CVE-2026-16750

Medium · published September 18, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
14.8
In the wild
Unconfirmed
What it is

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00244 · 14.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-18T02:16Z
References (2)
https://plugins.trac.wordpress.org/changeset/3684170/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/38d01b12-97ac-412b-b9df-c27118ce8f50?source=cve · [email protected]
EPSS history
Timeline
  • 19 SEP 03:50Z
    EPSS moved — → 0%
    epss
  • 17 SEP 21:28Z
    Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
    cvelistv5