CVE-2026-91016

The Motors WordPress plugin before version 1.4.121 fails to verify authorization before returning a user's non-published listings. An unauthenticated attacker can read any author's draft, pending, and private car listings —including titles, prices, media URLs, and seller notes—by supplying only t...