CVE-2022-3989

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload.

Score

CVSS 3.1 8.8 High

Status

Modified - contact@wpscan.com

Published

2022-12-12

Last modified

2025-04-22

Affected products

• Motors - Car Dealer, Classifieds & Listing (Stylemixthemes)
• Motors (Unknown)

References

• https://wpscan.com/vulnerability/1bd20329-f3a5-466d-81b0-e4ff0ca32091