The vulnerability arises from missing authorization checks in the WordPress Motors plugin, allowing an attacker to access restricted functionality such as editing or deleting vehicle listings. This flaw enables the abuse of incorrectly configured access control levels and can expose sensitive content within the plugin’s managed areas. The weakness is classified as CWE-862, indicating improper authorization controls, and may lead to unauthorized data exposure or manipulation.

WordPress sites that use StylemixThemes Motors fuel–dealer plugin versions up to and including 1.4.128 are affected. The plugin version range is from the initial release up to 1.4.128, as identified by the CNA. No additional WordPress core or other plugin interactions are listed as affected.

The CVSS score of 4.3 reflects moderate overall impact, and the EPSS score is not available, meaning no current evidence of exploit activity. The vulnerability appears to be exploitable by an unauthenticated or low‑privileged user through direct HTTP requests to plugin pages that lack proper permission checks. The absence of a KEV listing suggests no widespread exploitation has been reported, but the broken access control remains a concern for site owners who expose sensitive data.