The Motors – Car Dealership & Classified Listings Plugin for WordPress suffers from insufficient file path validation when deleting user profile pictures. This flaw permits an authenticated user with as little as Subscriber-level privileges to specify arbitrary file paths, leading to deletion of any writable file on the server. Removing or replacing critical files such as wp-config.php can result in remote code execution or site compromise. The weakness is a file‑path traversal/validation issue (CWE‑73).

All releases of the Motors – Car Dealership & Classified Listings Plugin from stylemix up to and including version 1.4.89 are affected. Any installation of the plugin at these versions on a WordPress site is vulnerable, regardless of WordPress core version.

The CVSS score of 8.1 classifies the issue as critical, though the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with at least Subscriber permissions, then exploit the profile picture deletion endpoint by providing an untrusted path. Because the plugin lacks strict path validation, the attacker can target any file within writable directories, providing a direct route to delete configuration files or inject malicious code.