CVE-2024-5545: Motors Car Dealer Plugin Auth Bypass Flaw

CVE-2024-5545 Overview

CVE-2024-5545 affects the Motors – Car Dealer, Classifieds & Listing plugin for WordPress developed by StylemixThemes. The vulnerability resides in the stm_edit_delete_user_car function, which lacks a capability check before executing privileged operations. Unauthenticated attackers can exploit this flaw over the network to unpublish arbitrary posts and pages on affected WordPress sites. The issue is classified as Missing Authorization [CWE-862] and impacts all plugin versions up to and including 1.4.8. Site owners running vulnerable installations face content availability disruption through remote, unauthenticated requests.

Critical Impact
Unauthenticated remote attackers can unpublish arbitrary posts and pages on any WordPress site running Motors plugin versions 1.4.8 or earlier, causing content availability and integrity issues.

Affected Products

StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin for WordPress
All versions up to and including 1.4.8
WordPress sites with the vulnerable plugin activated

Discovery Timeline

2024-07-02 - CVE-2024-5545 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5545

Vulnerability Analysis

The vulnerability stems from a missing authorization check inside the stm_edit_delete_user_car function exposed by the Motors plugin. The function processes user requests to edit or delete car listings, but it does not verify that the requester holds the required WordPress capability. Because the AJAX endpoint is reachable without authentication, any remote user can invoke it. Attackers can supply arbitrary post identifiers to the handler, and the function performs state-changing operations on those posts.

The scope extends beyond car listings. The handler operates on WordPress post objects using IDs supplied by the requester, so attackers can target pages, blog posts, and other custom post types. The result is unauthorized modification of post status, effectively unpublishing content and removing it from public visibility.

Root Cause

The root cause is a missing capability check [CWE-862]. The plugin registers an accessible action handler but omits calls to current_user_can() and does not validate the requester against a nonce tied to an authorized session. The handler assumes the invoker owns the referenced listing and proceeds to modify post state without verification.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends a crafted HTTP POST request to the plugin's AJAX endpoint targeting the stm_edit_delete_user_car action, supplying the ID of the post or page to unpublish. No authentication, user interaction, or elevated privileges are required. The vulnerability affects integrity but not confidentiality or availability of the underlying system.

See the Wordfence Vulnerability Report for additional technical detail on the vulnerable handler.

Detection Methods for CVE-2024-5545

Indicators of Compromise

Unexpected transitions of published posts or pages to draft or unpublished state without a corresponding administrator action in the WordPress audit log
HTTP POST requests to /wp-admin/admin-ajax.php containing the action parameter stm_edit_delete_user_car originating from unauthenticated sessions
Access log entries showing repeated admin-ajax.php requests from a single source IP targeting post IDs sequentially

Detection Strategies

Monitor WordPress access logs for POST requests to admin-ajax.php with the action=stm_edit_delete_user_car parameter, particularly from unauthenticated sources
Deploy a Web Application Firewall (WAF) rule that inspects admin-ajax.php traffic and blocks unauthenticated invocations of the vulnerable action
Correlate post status change events in the WordPress database with authenticated administrator sessions to identify anomalies

Monitoring Recommendations

Enable WordPress activity logging plugins to record all post status changes with source IP and user context
Alert on bulk post status changes occurring within short time windows, which indicate automated exploitation
Track plugin version inventory across managed WordPress sites and flag installations running Motors versions at or below 1.4.8

How to Mitigate CVE-2024-5545

Immediate Actions Required

Update the Motors – Car Dealer, Classifieds & Listing plugin to a version later than 1.4.8 immediately
Audit published posts and pages for unauthorized status changes since the plugin was installed
Restrict access to wp-admin/admin-ajax.php at the WAF or reverse proxy layer where feasible
Restore any incorrectly unpublished content from backups or by manually changing post status

Patch Information

StylemixThemes addressed the vulnerability in a plugin update following version 1.4.8. The fix adds a capability check to the stm_edit_delete_user_car handler so unauthenticated requests are rejected. Review the WordPress Plugin Change Log for the specific commit resolving the issue.

Workarounds

Deactivate the Motors plugin until the update can be applied if immediate patching is not possible
Deploy a WAF rule that blocks POST requests to admin-ajax.php containing the stm_edit_delete_user_car action from unauthenticated sources
Restrict access to the WordPress site using IP allowlisting during the remediation window if the site serves a limited audience

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1005545,msg:'Block CVE-2024-5545 exploitation'"
    SecRule ARGS:action "@streq stm_edit_delete_user_car" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"