CVE-2026-91016 Overview
CVE-2026-91016 is a broken access control vulnerability in the Motors WordPress plugin before version 1.4.121. The plugin fails to verify that a request is authorized to view a user's non-published listings before returning them. Unauthenticated attackers can read any author's draft, pending, and private car listings by supplying only the target's numeric user ID. Exposed data includes titles, prices, media URLs, and seller notes. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated attackers can enumerate and exfiltrate any author's unpublished car listings, exposing draft content, pricing strategy, media assets, and private seller notes.
Affected Products
- Motors WordPress plugin versions prior to 1.4.121
- WordPress sites using Motors classifieds or dealership functionality
- Any deployment exposing unauthenticated REST or AJAX endpoints from the plugin
Discovery Timeline
- 2026-09-17 - CVE-2026-91016 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91016
Vulnerability Analysis
The Motors plugin exposes an endpoint that returns car listings belonging to a specific author. The endpoint accepts a numeric user ID as input and returns listings owned by that user. The handler retrieves listings across all post statuses, including draft, pending, and private, without validating the requester's identity or capability.
A properly implemented handler would restrict non-published content to the owning author or users with the edit_others_posts capability. Because the plugin skips this check, any anonymous HTTP client can iterate user IDs and harvest unpublished inventory. Returned fields include listing titles, prices, media URLs, and free-form seller notes.
The impact is confined to information disclosure. Integrity and availability are not affected, and no authentication is required. Attackers gain visibility into pricing strategy, unreleased inventory, and any sensitive text stored in private drafts.
Root Cause
The root cause is a missing authorization check on a listings retrieval endpoint. The plugin trusts a client-supplied user identifier as an authorization key rather than deriving the requester's identity from the current session. This pattern maps directly to CWE-639, where object access is controlled by a user-modifiable parameter instead of a server-side authorization decision.
Attack Vector
An attacker sends unauthenticated HTTP requests to the vulnerable Motors endpoint, varying the numeric user ID. WordPress user IDs are sequential integers and often enumerable through other public endpoints. The response body contains non-public listings owned by the specified author. No session cookie, nonce, or API key is required. See the WPScan Vulnerability Report for reference details.
Detection Methods for CVE-2026-91016
Indicators of Compromise
- Repeated unauthenticated requests to Motors plugin listing endpoints containing a user_id or equivalent author parameter
- Sequential enumeration patterns across incrementing user ID values from a single source IP or user agent
- Unusually large response volumes from anonymous clients hitting listing routes
- Access log entries showing anonymous retrieval of listings whose corresponding posts are in draft, pending, or private status
Detection Strategies
- Alert on high-rate anonymous access to Motors plugin REST or AJAX routes
- Correlate WordPress access logs with post status to flag anonymous reads of non-published content
- Compare inbound request parameters against the site's known author ID range and alert on scans
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized analytics platform for query-driven detection
- Track baseline request rates against Motors plugin endpoints and alert on deviations
- Monitor Web Application Firewall (WAF) telemetry for user ID enumeration signatures
How to Mitigate CVE-2026-91016
Immediate Actions Required
- Upgrade the Motors WordPress plugin to version 1.4.121 or later on all affected sites
- Audit access logs for prior enumeration of the vulnerable endpoint and identify exposed drafts
- Rotate or redact sensitive content previously stored in private seller notes if exposure is confirmed
Patch Information
The vendor addressed CVE-2026-91016 in Motors plugin version 1.4.121. The fix enforces an authorization check that restricts non-published listings to their owning author and users holding equivalent WordPress capabilities. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict access to the vulnerable Motors listing endpoint at the WAF or reverse proxy until patching is complete
- Require authentication on Motors plugin routes through server-level access controls where feasible
- Temporarily disable the Motors plugin on sites that cannot be updated immediately
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
