The vulnerable function in the Motors – Car Dealership & Classified Listings Plugin allows authenticated users with Subscriber-level access or higher to install and activate any WordPress plugin. Because the code does not verify that the user possesses the capability to manage plugins, an attacker can bootstrap malicious plugin code onto the site. The presence of arbitrary code in a plugin can grant the attacker full control over the site’s filesystem and execution environment, potentially enabling remote code execution.

All WordPress sites running the Motors – Car Dealership & Classified Listings Plugin version 1.4.64 or earlier are affected. The issue was discovered in the setup wizard’s AJAX action handler and is present in all releases up to and including 1.4.64.

The CVSS score of 8.8 reflects a high severity. The EPSS score is < 1%, indicating that exploitation is currently unlikely, and the vulnerability is not listed in CISA KEV. The attack requires authentication as a Subscriber or higher, but because the capability check is omitted, an attacker only needs to be a logged‑in user, making the vulnerability relatively easy to exploit in a compromised or widely accessible site.