CVE-2025-2807

🗓️ 08 Apr 2025 09:21:18Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 62 Views🌐 WEB

CVE-2025-2807 allows authenticated users to install arbitrary plugins on WordPress sites up to 1.4.64.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Missing Authorization in Stylemixthemes Motors_-_Car_Dealer\,_Classifieds_\&_Listing	8 Apr 202510:24	–	githubexploit
Circl	CVE-2025-2807	8 Apr 202511:48	–	circl
CNNVD	WordPress plugin Motors – Car Dealership & Classified Listings Plugin 安全漏洞	8 Apr 202500:00	–	cnnvd
Cvelist	CVE-2025-2807 Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	8 Apr 202509:21	–	cvelist
EUVD	EUVD-2025-10319	3 Oct 202520:07	–	euvd
NVD	CVE-2025-2807	8 Apr 202510:15	–	nvd
Packet Storm News	WordPress Motors 1.4.64 Arbitrary Plugin Installation	8 Apr 202500:00	–	packetstormnews
Patchstack	WordPress Motors plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability	7 Apr 202521:58	–	patchstack
Positive Technologies	PT-2025-15413 · WordPress · Motors – Car Dealership & Classified Listings Plugin	8 Apr 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-2807	10 Apr 202509:46	–	redhatcve

NVD

Vulners

Node

stylemixthemes motors_-_car_dealer,_classifieds_&_listingRange<1.4.65wordpress

[
  {
    "vendor": "stylemix",
    "product": "Motors – Car Dealership & Classified Listings Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.4.64",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3262748/motors-car-dealership-classified-listings/trunk/includes/admin/setup-wizard/includes/ajax_actions.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/733f7666-468a-455c-a953-3d8946940f13

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Authenticated attacker with Subscriber+ can exploit missing capability check to trigger plugin installation via admin-ajax. The vulnerable AJAX action is mvl_setup_wizard_install_plugin.	CWE-862
plugin	request body	/wp-admin/admin-ajax.php	Authenticated attacker with Subscriber+ can exploit missing capability check to trigger plugin installation via admin-ajax. The vulnerable AJAX action is mvl_setup_wizard_install_plugin.	CWE-862
nonce	request body	/wp-admin/admin-ajax.php	Authenticated attacker with Subscriber+ can exploit missing capability check to trigger plugin installation via admin-ajax. The vulnerable AJAX action is mvl_setup_wizard_install_plugin.	CWE-862

08 Apr 2026 17:00Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.8

EPSS0.00855

SSVC

CWE-862