CVE-2026-91023 Overview
CVE-2026-91023 is a missing authorization vulnerability in the Motors WordPress plugin before version 1.4.124. The plugin fails to verify that a user is authorized to modify a listing before processing listing management actions. Authenticated attackers with subscriber-level access or higher can set metadata on posts they do not own, including overwriting product prices. Exploitation requires WooCommerce to be active and the paid featured-listing option to be enabled, neither of which is a default configuration.
Critical Impact
Authenticated subscribers can tamper with WooCommerce product metadata, including price fields, on listings owned by other users.
Affected Products
- Motors WordPress plugin versions before 1.4.124
- Deployments with WooCommerce active
- Deployments with the paid featured-listing option enabled
Discovery Timeline
- 2026-10-02 - CVE-2026-91023 published to the National Vulnerability Database (NVD)
- 2026-10-02 - Last updated in NVD database
Technical Details for CVE-2026-91023
Vulnerability Analysis
The Motors plugin exposes listing management actions that modify post metadata on behalf of the current user. The handler processing these actions does not confirm that the requester owns the target listing. Any authenticated account at subscriber level or higher can submit a crafted request referencing a listing ID that belongs to another user and update its metadata fields.
The most impactful consequence is overwriting WooCommerce product prices. An attacker can lower prices on listings they do not own and then purchase those items at the manipulated amount. Other metadata fields exposed by the plugin's listing management interface are also writable through the same path.
The weakness maps to CWE-862: Missing Authorization. The vulnerable code path authenticates the caller but omits the ownership check that would restrict actions to the listing's author.
Root Cause
The listing management handler performs an authentication check but not an authorization check. It accepts a listing identifier from the request without validating that the authenticated user is the listing's owner or holds a role permitted to edit arbitrary listings. Metadata writes proceed on whatever post identifier the attacker supplies.
Attack Vector
Exploitation is remote and requires an authenticated session. The attacker registers or uses an existing subscriber-level account on the target WordPress site. They then invoke the plugin's listing management action with the target listing ID and the metadata values they want to set, including the WooCommerce price meta key. The attack succeeds only when WooCommerce is active and the Motors paid featured-listing option is enabled.
See the WPScan Vulnerability Report for the technical write-up.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-91023
Indicators of Compromise
- Unexpected changes to _price, _regular_price, or _sale_price meta on WooCommerce products linked to Motors listings
- WooCommerce orders completed at prices significantly below the configured listing price
- Post meta modifications on listings whose post_author does not match the acting user ID in audit logs
Detection Strategies
- Review WordPress and WooCommerce audit logs for metadata updates performed by subscriber-level accounts against listings they do not own
- Compare current WooCommerce product prices against known-good exports and flag downward deltas
- Inspect web server access logs for POST requests to Motors listing management endpoints originating from low-privilege sessions
Monitoring Recommendations
- Enable a WordPress activity log plugin that records post meta changes with actor, target post ID, and old/new values
- Alert on orders where the paid price is below a defined percentage of the historical listing price
- Monitor new subscriber registrations that are quickly followed by requests to listing management endpoints
How to Mitigate CVE-2026-91023
Immediate Actions Required
- Update the Motors WordPress plugin to version 1.4.124 or later
- If an immediate update is not possible, disable the paid featured-listing option in the Motors plugin settings
- Audit WooCommerce product prices and recent orders for signs of price tampering
Patch Information
The vendor addressed the issue in Motors WordPress plugin version 1.4.124 by adding the missing ownership check to the listing management action handler. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the Motors plugin's paid featured-listing feature until the update is applied
- Deactivate WooCommerce on the affected site if the integration is not required, which removes the price-overwrite impact
- Restrict new user registration or require administrator approval to limit the pool of subscriber-level accounts that can reach the vulnerable action
# Update the Motors plugin via WP-CLI
wp plugin update motors --version=1.4.124
# Verify the installed version
wp plugin get motors --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
