The vulnerability allows an authenticated WordPress user with Subscriber level or higher to modify the private field stm_payment_status for their own profile. By setting this field to "completed", the user bypasses PayPal payment verification and immediately gains access to paid Dealer membership features. The flaw arises because the stm_save_user_extra_fields() function accepts POST data for sensitive user meta without ensuring the editing user has the proper capability to modify that specific field.

The issue affects the Motors – Car Dealership & Classified Listings plugin for WordPress versions up to and including 1.4.103. No other versions are documented as vulnerable.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The attack is limited to authenticated users who can edit their own profile; an attacker can trigger the bypass simply by crafting a POST request to the plugin’s user profile page and setting stm_payment_status to "completed". No additional exploitation prerequisites are noted in the advisory.