The Motors – Car Dealership & Classified Listings Plugin allows authenticated users with the Subscriber role or higher to delete arbitrary files located under the wp-content/uploads directory. This occurs because the stm_listings_ajax_save_user_data function does not validate the file path supplied in the stm_user_avatar_path user meta field, representing a path traversal weakness (CWE‑22). Based on the description, the deletion is restricted to uploads and cannot reach core configuration files such as wp-config.php. The resultant impact is the loss of user uploads or site integrity, which could disrupt normal operation or content availability.

WordPress installations that use the stylemix Motors plugin versions up to and including 1.4.125 are affected. Site administrators need to verify the plugin version and upgrade if possible.

The CVSS score of 8.1 indicates high severity. EPSS data is not available and this vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user submitting an AJAX request from any front‑end page where the AJAX nonce is printed, and supplying a writable stm_user_avatar_path meta value that points to a target file under wp-content/uploads. Because any logged‑in user can write their own stm_user_avatar_path meta, exploitation is trivial for sites that follow default WordPress authentication and user role practices.