Read the docs
TI-2021-06667 Aliases CVE-2021-24375GHSA-7ww7-rp6j-6vrg

Motor theme < 3.1.0 - Local File Inclusion

Priority MEDIUM 47CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.

Why it matters now

EPSS 0.02633 85th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Motor (Stockware): 3.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
StockwareMotor3.1.0 to before 3.1.03.1.0Patch availableCNA
  • Motor VendorStockware Affected 3.1.0 to before 3.1.0 Fixed in 3.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:stockware:motor:*:*:*:*:*:wordpress:*:*before 3.1.0VulnerableStockware
  • cpe:2.3:a:stockware:motor:*:*:*:*:*:wordpress:*:* Versions before 3.1.0 Vulnerable ·Stockware

Remediation

  • Fix · CNA Motor (Stockware) Fixed in 3.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24375
  2. 2026-10-03 Alias added: GHSA-7ww7-rp6j-6vrg

References

Exploit 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences