CVE-2022-3989

Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload.

Affected

Motors

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.12% chance of exploitation in the next 30 days, 66th percentile

Published

2022-12-12

Updated

2025-04-22

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1bd20329-f3a5-466d-81b0-e4ff0ca32091

References

• CVE Record
• NVD entry