CVE-2024-10970 is a code injection vulnerability in the Motors – Car Dealer, Classifieds & Listing WordPress plugin by stylemix. The flaw arises from improper validation of user-supplied input before executing do_shortcode, enabling authenticated users with Subscriber-level privileges or higher to run arbitrary shortcodes. This can lead to unauthorized code execution within the context of the WordPress site. The vulnerability affects all versions up to and including 1.4.43. The CVSS 3.1 score of 5.4 reflects a medium risk with network attack vector, low attack complexity, and privileges required at the low level.

An attacker with at least Subscriber-level access can exploit this vulnerability to execute arbitrary shortcodes, potentially leading to unauthorized code execution or manipulation of site content. The impact is limited to confidentiality and integrity with no direct availability impact reported. Since the attacker must be authenticated, the risk is mitigated somewhat by access controls, but it still poses a threat to site security and data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only and monitor for suspicious shortcode usage. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from stylemix for any forthcoming patches or security advisories.