Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload
Priority HIGH 73Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01123 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Motors (Unknown): 1.4.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Motors | before 1.4.4 | 1.4.4 | Patch available | CNA |
- Motors VendorUnknown Affected before 1.4.4 Fixed in 1.4.4 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:stylemixthemes:motors_-_car_dealer\,_classifieds_\&_listing:*:*:*:*:*:wordpress:*:* | before 1.4.4 | Vulnerable | StylemixThemes |
- cpe:2.3:a:stylemixthemes:motors_-_car_dealer\,_classifieds_\&_listing:*:*:*:*:*:wordpress:*:* Versions before 1.4.4 Vulnerable ·StylemixThemes
Remediation
- Fix · CNA Motors (Unknown) Fixed in 1.4.4
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3989
- 2026-10-03 Alias added: GHSA-v968-jc69-vxr8
References
More StylemixThemes Motors - Car Dealer, Classifieds & Listing vulnerabilities
- TI-2025-02451 Missing authorization in StylemixThemes Motors – Car Dealership & Classified Listings… CVSS 3.1HIGH 8.8
- TI-2022-18246 WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
- TI-2023-24834 WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF) CVSS 3.1HIGH 7.5
- TI-2019-12845 includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car… CVSS 3.1MEDIUM 6.5
- TI-2023-24835 WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
- TI-2024-05153 Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-3989 · CVE Program
- CVE-2022-3989 · NVD
- FIRST EPSS
- GHSA-v968-jc69-vxr8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences