CVE-2026-12435 Overview
CVE-2026-12435 is an authorization bypass vulnerability in the Motors – Car Dealership & Classified Listings Plugin for WordPress. The flaw affects all versions up to and including 1.4.111. The plugin fails to verify that a user is authorized to perform the stm_mark_as_sold_car action against a given listing. Authenticated attackers with Subscriber-level access or above can mark or unmark any other user's car listing as sold. The attack replays a valid nonce harvested from the attacker's own listing against an arbitrary victim post ID. This vulnerability is categorized under [CWE-862] Missing Authorization.
Critical Impact
Subscriber-level users can toggle the 'Sold' badge on any listing site-wide and silently strip the special_car featured post meta as a side effect.
Affected Products
- Motors – Car Dealership & Classified Listings Plugin for WordPress
- All versions through 1.4.111
- WordPress sites using the plugin with open Subscriber registration
Discovery Timeline
- 2026-07-01 - CVE-2026-12435 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-12435
Vulnerability Analysis
The vulnerability resides in the plugin's handler for the stm_mark_as_sold_car AJAX action. The handler validates a WordPress nonce but does not confirm that the requesting user owns the target post ID. WordPress nonces are user-scoped tokens tied to an action name, not to a specific object. As a result, any nonce a user legitimately generates for their own listing remains valid for the same action against every other listing on the site.
An authenticated attacker with Subscriber access first creates a listing through the plugin's add-listing form. From their own listing page they harvest the nonce generated for the sold-toggle action. They then submit that nonce against arbitrary victim post IDs to toggle the 'Sold' state on listings they do not own.
A notable side effect is that the handler removes the special_car post meta when marking a listing sold. Attackers can therefore quietly strip featured or promoted status from competitor listings.
Root Cause
The root cause is missing object-level authorization ([CWE-862]). The affected code paths in includes/vehicle_functions.php and templates/listing-cars/listing-list-owner-actions.php rely on nonce verification alone. They do not call current_user_can() against the listing's author or otherwise confirm ownership of the post ID supplied in the request.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated Subscriber account. Sites that allow open registration expose the vulnerability to anyone on the internet. The attacker must own at least one listing to obtain a valid nonce. Once the nonce is captured, the attacker sends a POST request to admin-ajax.php with the stm_mark_as_sold_car action and a post_id parameter set to the victim listing.
The vulnerability manifests in the listing action handler referenced in the plugin source at vehicle_functions.php line 2400 and the owner actions template at line 74. See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for technical details.
Detection Methods for CVE-2026-12435
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=stm_mark_as_sold_car originating from Subscriber accounts
- Unexpected changes to the sold post meta on listings not owned by the requesting user
- Removal of special_car post meta from featured listings without an audit-log entry from the listing owner
- Support tickets from listing owners reporting a 'Sold' badge they did not set
Detection Strategies
- Correlate WordPress access logs against post authorship: flag any stm_mark_as_sold_car request where the authenticated user ID does not match the target post's post_author
- Enable WordPress activity logging plugins to capture post meta changes, focusing on sold and special_car keys
- Review the plugin version in wp-content/plugins/motors-car-dealership-classified-listings/ against the patched release
Monitoring Recommendations
- Alert on bursts of stm_mark_as_sold_car requests from a single Subscriber account within a short window
- Baseline the normal rate of sold-state toggles per site and alert on deviations
- Monitor new Subscriber registrations followed within minutes by listing creation and outbound AJAX activity
How to Mitigate CVE-2026-12435
Immediate Actions Required
- Update the Motors – Car Dealership & Classified Listings Plugin to a version above 1.4.111 as soon as a fixed release is available
- Audit existing listings for unauthorized sold state and restored special_car meta values
- Temporarily disable open Subscriber registration if the plugin cannot be updated immediately
Patch Information
Review the WordPress Plugin Change Log for the vendor's remediation commit. Confirm the installed version is later than 1.4.111 before re-enabling public registration. Refer to the Wordfence Vulnerability Report for the fixed version and additional guidance.
Workarounds
- Restrict the stm_mark_as_sold_car AJAX action at the web application firewall (WAF) level to authenticated requests where the user ID matches the post author
- Disable the plugin's front-end owner actions template until a patch is applied
- Set WordPress users_can_register to false to prevent unauthenticated attackers from obtaining Subscriber accounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
