CVE-2025-2807

Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins on the affected site's server which may make remote code execution possible.

Affected

stylemix · Motors – Car Dealership & Classified Listings Plugin

CVSS v3.1 WORDFENCE

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.91% chance of exploitation in the next 30 days, 59th percentile

Published

2025-04-08

Updated

2026-04-08

Proof-of-concept exploits (1)

• Nxploited/CVE-2025-28070★ · 2025-04-08

Security advisories

• https://www.wordfence.com/threat-intel/vulnerabilities/id/733f7666-468a-455c-a953-3d89469…
• https://plugins.trac.wordpress.org/changeset/3262748/motors-car-dealership-classified-lis…

References

• CVE Record
• NVD entry