This vulnerability is an unauthenticated broken access control flaw in the StylemixThemes Motors WordPress plugin through version 1.4.109. It allows an attacker without valid credentials to bypass the plugin’s authorization checks, potentially exposing or modifying protected data such as user accounts, listings, or other sensitive information. The weakness is classified as CWE-862, which highlights the absence of proper access control enforcement.

WordPress sites that have the StylemixThemes Motors plugin version 1.4.109 or any earlier revision are affected. Sites using 1.4.110 or newer are not vulnerable because the vendor released a patch addressing the access‑control oversight.

The CVSS base score is 7.5, indicating a high severity consequence. The EPSS score is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. It is inferred that the likely attack vector involves interacting with the plugin’s exposed endpoints or API calls, enabling an attacker to exploit the flaw remotely without needing user authentication. Attackers can exploit the flaw remotely by interacting with the plugin’s exposed endpoints or API calls, requiring no user authentication. Overall, the risk to confidentiality, integrity, and availability is significant for affected sites.