The vulnerability is an Insecure Direct Object Reference (IDOR), allowing an attacker to manipulate a user-controlled key to bypass access controls. This flaw can grant unauthorized access to other vehicle listings, reviews, or administrative settings within the Stylemix Motors plugin, potentially compromising confidentiality, integrity, or availability of dealership data. The weakness is classified as CWE‑639, indicating that the software fails to correctly enforce authorization checks when processing user input.

The affected component is the Stylemix Motors "motors‑car‑dealership‑classified‑listings" WordPress plugin, version 1.4.80 and earlier. No specific sub‑versions are listed, so all releases from the initial introduction up to and including 1.4.80 are susceptible.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is below 1%, suggesting a very low current probability of exploitation. The vulnerability is not listed in CISA KEV catalog. Exploitation would likely occur via a remote web request, with an attacker crafting a URL or form submission containing a manipulated key to access resources that belong to other users. No specific privilege escalation or code execution is required; the primary risk is unauthorized data access.