CVE-2026-105971

MediumCVSS 5.3/10Last modified Nov 6, 2026

Description

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Car Dealer (Dealership) and Vehicle sales	<= 4.73

References

https://wpscan.com/vulnerability/fd2f5dbc-3a93-47d0-8941-3147e85d5d16/

Timeline

Published: Nov 5, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1059727.5The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in it CVE-2026-1059734.3The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing an CVE-2026-1059744.3The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data i CVE-2026-1059755.3The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and CVE-2026-1059764.7The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing CVE-2026-1059772.2The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment,CVE-2026-1059787.2Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system comman CVE-2026-1059797.2Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execut CVE-2026-1059807.2Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execu CVE-2026-1059817.2Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands a CVE-2026-1059827.2Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute t CVE-2026-1059858.8Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any