CVE-2025-10494

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with...

CVE-2025-10494

creationtimestamp| type| source ---|---|--- 2025-10-08 06:50:19+00:00| seen| https://gist.github.com/Darkcrai86/d715a7a30521fd39c672c27209220364...

WordPress Motors – Car Dealership & Classified Listings Plugin plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Kishan Vyas in WordPress Plugin Motors versions = 1.4.89...