The vulnerability arises from a missing capability check in the ajax_actions.php file of the Motors – Car Dealership & Classified Listings Plugin. This omission allows any authenticated user with Subscriber-level access or higher to invoke several initial set‑up functions that were intended to be restricted to administrators. As a result, attackers can modify plugin configuration data, potentially altering listings, dealership information, or other critical settings without proper authorization.

WordPress sites running stylemix:Motors – Car Dealership & Classified Listings Plugin versions up to and including 1.4.66 are affected. All installations of these versions are vulnerable to the unauthorized modification of data.

The CVSS score is 4.3, indicating moderate risk, while the EPSS score of less than 1% suggests a low exploitation probability at the time of analysis. The vulnerability is not present in the CISA KEV catalog. Attackers must be authenticated but only need Subscriber-level privileges, which are commonly granted. An attacker who can log in as a Subscriber can trigger the set‑up actions that are currently missing authorization checks. Since the problem exists in all prior releases, the widest range of sites is potentially exploitable until the plugin is updated.