CVE-2025-10494: Motors WordPress Plugin RCE Vulnerability

CVE-2025-10494 Overview

CVE-2025-10494 is an arbitrary file deletion vulnerability in the Motors – Car Dealership & Classified Listings Plugin for WordPress. The flaw affects all versions up to and including 1.4.89. It stems from insufficient file path validation in the profile picture deletion logic.

Authenticated attackers with Subscriber-level access or higher can delete arbitrary files on the underlying server. Deletion of sensitive files such as wp-config.php can lead to remote code execution by forcing the site into setup mode. The issue is tracked under CWE-73: External Control of File Name or Path.

Critical Impact
A Subscriber-level account can delete wp-config.php and pivot to full site takeover and remote code execution.

Affected Products

Motors – Car Dealership & Classified Listings Plugin for WordPress
All versions up to and including 1.4.89
WordPress installations with the plugin activated and user registration enabled

Discovery Timeline

2025-10-08 - CVE-2025-10494 published to the National Vulnerability Database
2026-04-15 - CVE-2025-10494 last updated in NVD

Technical Details for CVE-2025-10494

Vulnerability Analysis

The Motors plugin exposes a profile picture deletion handler accessible to any authenticated user holding at least the Subscriber role. The handler accepts a user-supplied file path or filename and removes the referenced file from disk. It fails to validate that the path resolves inside the plugin's upload directory.

Because path sanitization is missing, attackers can supply traversal sequences such as ../../wp-config.php to escape the intended directory. The deletion call then executes against arbitrary locations within the WordPress root and beyond, limited only by the web server's filesystem permissions. WordPress runs the deletion under the PHP process user, which typically owns the entire site directory.

Deleting wp-config.php removes the database configuration. On the next request, WordPress treats the site as uninitialized and serves the installation wizard. An attacker can then complete the wizard against a database server they control and inject a malicious theme or plugin, achieving remote code execution.

Root Cause

The root cause is improper external control of file name or path [CWE-73]. The deletion routine trusts client-supplied input for the target filename and does not enforce a canonical base directory check or an allowlist of expected files.

Attack Vector

Exploitation is performed over the network against the WordPress REST or AJAX endpoint exposed by the plugin. The attacker first registers a Subscriber account, which is enabled by default on many sites running the plugin. The attacker then sends a crafted profile picture deletion request containing a path traversal payload pointing at a high-value file such as wp-config.php, .htaccess, or a security plugin's bootstrap file.

No user interaction is required. Privileges required are low. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-10494

Indicators of Compromise

Missing or unexpectedly recreated wp-config.php, .htaccess, or index.php files in the WordPress root
WordPress installation wizard appearing on a previously operational site
HTTP requests to plugin AJAX or REST endpoints containing ../ sequences in profile picture parameters
Subscriber accounts created shortly before file deletion or setup activity

Detection Strategies

Inspect web server access logs for plugin endpoints under /wp-admin/admin-ajax.php or /?rest_route= with parameters referencing wp-config, .htaccess, or traversal patterns
Enable WordPress file integrity monitoring to alert on deletion of core, theme, or configuration files
Correlate new low-privilege user registrations with subsequent profile-related POST requests to the Motors plugin

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for retention and query
Alert on filesystem unlink events targeting paths outside the plugin's uploads directory
Monitor for HTTP 200 responses from the Motors profile picture deletion endpoint followed by 500 errors on subsequent page loads, which can indicate successful deletion of critical files

How to Mitigate CVE-2025-10494

Immediate Actions Required

Update the Motors – Car Dealership & Classified Listings Plugin to a version newer than 1.4.89 as published in the WordPress Changeset Update
Audit existing user accounts and remove unrecognized Subscriber-level registrations
Verify the integrity of wp-config.php, .htaccess, and other root-level WordPress files

Patch Information

The vendor addressed the vulnerability in the plugin update referenced by the WordPress Plugin Changeset 3369415. The fix introduces proper validation of the file path before deletion. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

Disable open user registration in WordPress settings until the plugin is updated
Restrict the plugin's AJAX and REST endpoints with a web application firewall rule blocking ../ and absolute path patterns in profile picture parameters
Apply restrictive filesystem permissions so the PHP process cannot delete wp-config.php or files outside wp-content/uploads
Deactivate the Motors plugin if a timely update cannot be applied

bash

# Restrict write/delete on wp-config.php at the filesystem level
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php
chattr +i /var/www/html/wp-config.php