A missing authorization flaw in StylemixThemes Motors, affecting versions up to 1.4.128, allows attackers to bypass configured security levels. The vulnerability is classified as a CWE‑862 Missing Authorization issue. If exploited, an attacker could potentially access restricted plugin features or data, violating confidentiality and integrity of the site content.

The vulnerability impacts the WordPress Motors plug‑in “Motors: Car Dealership Classified Listings” produced by StylemixThemes. Any installation running the plug‑in from the earliest version available through 1.4.128 is potentially exposed.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score is currently not available. Since the vulnerability is listed in neither the KeV nor derived from external exploit data, the likelihood of widespread exploitation is unclear. Attackers would need to exploit incorrectly configured access controls, which is possible purely through the plug‑in’s user interface or API if the site’s settings allow unauthorized users to reach the affected code paths. Based on the description, the likely attack vector is a web-based privilege escalation attempt via the plug‑in’s administrative functions.