CVE-2026-1934: Motors WordPress Plugin Auth Bypass Flaw

CVE-2026-1934 Overview

CVE-2026-1934 is a missing authorization vulnerability [CWE-862] in the Motors – Car Dealership & Classified Listings plugin for WordPress. The flaw affects all plugin versions up to and including 1.4.103. The stm_save_user_extra_fields() function updates sensitive user meta fields directly from POST data without verifying that the current user is permitted to modify those specific fields. Authenticated attackers with Subscriber-level access or above can set their own stm_payment_status user meta to completed, bypassing PayPal payment verification and unlocking paid Dealer membership features without any transaction.

Critical Impact

Authenticated Subscriber-level users can bypass PayPal payment verification and gain Dealer membership privileges without paying, resulting in revenue loss and unauthorized access to paid features.

Affected Products

• Motors – Car Dealership & Classified Listings plugin for WordPress
• All versions up to and including 1.4.103
• Fixed in version 1.4.104

Discovery Timeline

• 2026-05-12 - CVE-2026-1934 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-1934

Vulnerability Analysis

The vulnerability resides in the stm_save_user_extra_fields() function within includes/user-extra.php of the Motors plugin. The function hooks into the WordPress personal_options_update action, which fires when a user submits their own profile edit form. Its only authorization check is current_user_can('edit_user', $user_id), a capability check that passes for any authenticated user editing their own profile.

After passing that check, the function writes user meta fields directly from $_POST data without distinguishing between fields the user legitimately controls (such as display preferences) and privileged fields that govern billing and membership state. One of those privileged fields is stm_payment_status, which the plugin consults to determine whether a user has completed a PayPal payment for Dealer membership.

By submitting a crafted profile update request that includes stm_payment_status=completed, a Subscriber can grant themselves Dealer-tier privileges. This is a business logic flaw rooted in broken access control rather than a memory safety or injection issue.

Root Cause

The root cause is missing field-level authorization [CWE-862]. The plugin treats the edit_user capability as sufficient to write any user meta key, instead of maintaining an allowlist of user-editable fields and rejecting privileged keys such as stm_payment_status. Sensitive billing state is stored as ordinary user meta with no server-side trust boundary.

Attack Vector

An attacker registers a Subscriber account on a vulnerable site or uses an existing low-privilege account. The attacker submits the profile edit form with an additional POST parameter stm_payment_status set to completed. The plugin writes the value to user meta. On the next request, the plugin's membership logic reads the forged value and grants access to paid Dealer features without any PayPal transaction occurring.

The vulnerability is network-accessible, requires low privileges, and needs no user interaction. No exploitation code is required beyond a single authenticated HTTP POST. Refer to the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for the vulnerable code path.

Detection Methods for CVE-2026-1934

Indicators of Compromise

• User accounts whose stm_payment_status user meta equals completed with no corresponding PayPal transaction record or order entry.
• Subscriber-level accounts that transitioned to Dealer-tier access without an associated payment event in plugin or PayPal logs.
• HTTP POST requests to profile.php or the WordPress user profile update endpoint containing the parameter stm_payment_status.

Detection Strategies

• Audit the wp_usermeta table for rows where meta_key = 'stm_payment_status' and meta_value = 'completed', then reconcile against authoritative PayPal payment records.
• Inspect web server access logs for POST requests to user profile endpoints containing unexpected plugin-specific meta keys in the request body.
• Correlate user role or membership-tier changes with the absence of PayPal IPN or transaction callbacks.

Monitoring Recommendations

• Enable WordPress audit logging for user meta updates and alert on writes to stm_payment_status originating from non-administrative sessions.
• Monitor the Motors plugin version reported by WordPress sites and flag any instance running 1.4.103 or earlier.
• Track new Subscriber registrations followed shortly by Dealer feature usage without intervening payment events.

How to Mitigate CVE-2026-1934

Immediate Actions Required

• Update the Motors – Car Dealership & Classified Listings plugin to version 1.4.104 or later on all affected WordPress sites.
• Audit existing user accounts for forged stm_payment_status values and revoke Dealer privileges from any account lacking a matching PayPal transaction.
• Review web server logs since the plugin was installed for POST requests containing stm_payment_status to identify prior exploitation attempts.

Patch Information

The vendor addressed the issue in version 1.4.104. The fix is published in WordPress Plugin Changeset 3468174 and documented in the WordPress Plugin Version Change Log. The patched stm_save_user_extra_fields() function restricts which user meta keys can be written from POST data, preventing privileged fields from being modified by non-administrative users.

Workarounds

• If immediate patching is not possible, restrict access to the WordPress user registration and profile endpoints using a Web Application Firewall (WAF) rule that blocks requests containing the stm_payment_status parameter from non-administrator sessions.
• Temporarily disable open Subscriber registration on the affected site until the plugin is updated.
• Implement a server-side filter via a custom mu-plugin to unset the stm_payment_status key from $_POST before the personal_options_update action fires.

# Example WAF rule pattern to block the exploit parameter
# ModSecurity-style rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1002026,msg:'CVE-2026-1934 Motors plugin payment bypass attempt'"
SecRule ARGS_NAMES "@streq stm_payment_status" "t:lowercase"