CVE-2026-91023

LowCVSS 3.1/10Last modified Oct 2, 2026

Description

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2026
Last modified: Oct 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-910246.8The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before CVE-2026-910254.3The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin befo CVE-2026-91039.8IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v CVE-2026-910399.1Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider con CVE-2026-91046.4The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, CVE-2026-910417.8Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is at CVE-2026-910438.2Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on CVE-2026-910464.3The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several o CVE-2026-910475.3The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product dow CVE-2026-910489.8The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a co CVE-2026-91056.5An authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authen CVE-2026-910504.3The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec