CVE-2025-54691: Motors Plugin Auth Bypass Vulnerability

CVE-2025-54691 Overview

CVE-2025-54691 is an Insecure Direct Object Reference (IDOR) vulnerability in the Stylemix motors-car-dealership-classified-listings WordPress plugin, commonly known as Motors. The flaw stems from Authorization Bypass Through User-Controlled Key [CWE-639], where the plugin fails to validate that a requesting user owns the object identified by a user-supplied key. Attackers can manipulate object identifiers in requests to access resources belonging to other users. The issue affects all Motors plugin versions up to and including 1.4.80. Exploitation requires no authentication and no user interaction, and it is reachable over the network.

Critical Impact
Unauthenticated network attackers can access confidential listing or user data by tampering with object identifiers in requests to the Motors plugin.

Affected Products

Stylemix Motors — motors-car-dealership-classified-listings WordPress plugin
All versions from initial release through 1.4.80
WordPress sites running the Motors car dealership/classified listings plugin

Discovery Timeline

2025-08-14 - CVE-2025-54691 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54691

Vulnerability Analysis

The Motors plugin exposes endpoints that accept an object identifier supplied by the client and use it directly to look up records. The plugin does not verify that the authenticated session, or lack thereof, is permitted to access the referenced object. This behavior matches the Insecure Direct Object Reference pattern captured by [CWE-639]. Because the vulnerable request path is network-reachable and requires no privileges, an attacker can iterate through identifier values and retrieve data intended for other users. Impact is limited to confidentiality: an attacker can read data but cannot modify records or disrupt service through this flaw alone.

Root Cause

The plugin trusts a user-controlled key, such as a numeric listing or record ID, without cross-checking ownership or role. Access control decisions rely on the presence of the identifier itself rather than on server-side authorization checks tied to the requesting principal.

Attack Vector

An unauthenticated attacker sends HTTP requests to a vulnerable Motors plugin endpoint on a target WordPress site. By substituting or enumerating the object identifier parameter, the attacker retrieves records owned by other users. No credentials, tokens, or social engineering are required. See the Patchstack Vulnerability Report for the technical write-up.

No verified public exploit code has been published for this CVE. The vulnerability mechanism can be summarized in prose: the vulnerable endpoint accepts a resource identifier from the client, queries the backing store using that identifier, and returns the record without confirming the caller's authorization to view it.

Detection Methods for CVE-2025-54691

Indicators of Compromise

Repeated HTTP requests to Motors plugin endpoints with sequentially incrementing or fuzzed numeric identifiers.
Access log entries showing a single client enumerating many distinct object IDs in a short timeframe.
Anomalous read volume against /wp-admin/admin-ajax.php or Motors-specific REST routes from unauthenticated sources.

Detection Strategies

Monitor web server and WordPress access logs for high-cardinality parameter values on Motors plugin routes.
Correlate unauthenticated sessions with responses that return distinct user or listing data across many requests.
Deploy Web Application Firewall (WAF) rules that flag ID enumeration patterns against known Motors endpoints.

Monitoring Recommendations

Alert on bursts of 200 OK responses to Motors plugin URLs from a single IP with varied identifier parameters.
Track baseline request rates for the Motors plugin and generate anomalies for sustained deviations.
Retain WordPress and reverse-proxy logs long enough to reconstruct enumeration attempts after disclosure.

How to Mitigate CVE-2025-54691

Immediate Actions Required

Inventory all WordPress sites running the Motors plugin and identify installations at version 1.4.80 or earlier.
Update the Motors plugin to a version later than 1.4.80 as soon as the vendor publishes a fix.
Restrict access to Motors administrative and listing endpoints through WAF rules or IP allowlisting until patched.

Patch Information

The vulnerability affects Motors plugin versions up to and including 1.4.80. Administrators should consult the Patchstack Vulnerability Report and the vendor's plugin changelog for the fixed release, then upgrade all affected sites.

Workarounds

Temporarily disable the Motors plugin on sites where an immediate upgrade is not feasible.
Apply virtual patching via a WAF to block requests containing unexpected or enumerated identifier values on Motors routes.
Enforce authentication requirements on affected endpoints through reverse-proxy access controls where possible.

bash

# Example WAF rule concept (ModSecurity) to rate-limit ID enumeration
# Adjust route and parameter names to match your Motors deployment
SecRule REQUEST_URI "@beginsWith /wp-admin/admin-ajax.php" \
  "id:1054691,phase:1,pass,nolog,\
   setvar:ip.motors_hits=+1,expirevar:ip.motors_hits=60"
SecRule IP:motors_hits "@gt 60" \
  "id:1054692,phase:1,deny,status:429,log,\
   msg:'Possible IDOR enumeration against Motors plugin'"