High severity8.8NVD Advisory· Published Apr 8, 2025· Updated Jun 17, 2026
CVE-2025-2807
CVE-2025-2807
Description
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins on the affected site's server which may make remote code execution possible.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- cpe:2.3:a:stylemixthemes:motors_-_car_dealer\,_classifieds_\&_listing:*:*:*:*:*:wordpress:*:*Range: <1.4.65
- Range: <=1.4.64
- stylemix/Motors – Car Dealership & Classified Listings Pluginv5Range: 0
- Package: https://wordpress.org/themes/motors
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.