Veille CVE

‹ Retour à la liste

CVE-2026-91023

3.1 Faible

Publiée le 02/10/2026 à 08:16 · Modifiée le 02/10/2026 à 20:00 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 3.1 Faible 134c704f-9b21-4f2e-91b3-4a467353bcc0 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Faiblesses (CWE)

Références

Ailleurs