The weakness lies in the Motors plugin’s dealer logo upload flow where the 'stm_dealer_logo_path' parameter is insufficiently validated. An authenticated user with subscriber-level or higher privileges can submit any filesystem path, causing the plugin to delete the referenced file. This is a classic file deletion path traversal flaw (CWE‑73). The result is that the attacker can remove arbitrary files on the server, potentially including critical configuration files or data, thereby compromising the site’s confidentiality, integrity, and availability.

The vulnerability affects the Stylemix Motors – Car Dealership & Classified Listings Plugin for WordPress. All instances of version 1.4.107 and earlier are impacted; no later versions are known to be vulnerable.

With a CVSS score of 8.1 the issue is deemed high severity. The exploit requires authentication—subscriber-level access or higher—which is commonly granted to normal users of the plugin. No EPSS data is publicly available, and it is not listed in CISA KEV. The attack vector is local to the authenticated user; once logged in, the user can delete arbitrary files on the server, potentially leading to further compromise if sensitive files are targeted.