The Motors – Car Dealership & Classified Listings plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in the motors_create_template and motors_delete_template functions. This flaw allows authenticated users with low privileges (Subscriber-level and above) to create or delete listing templates arbitrarily. The vulnerability requires the Elementor plugin to be installed, as it is a dependency for the Motors Starter Theme. The CVSS 3.1 base score is 4.3 (medium severity), reflecting that the attack vector is network-based, requires low privileges, no user interaction, and impacts integrity but not confidentiality or availability. No patch or remediation has been confirmed.

An authenticated user with Subscriber-level access or higher can exploit this vulnerability to create or delete listing templates arbitrarily within the affected plugin. This could lead to unauthorized modification of data, potentially disrupting the listing content or structure on the WordPress site. There is no evidence of confidentiality or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access where possible and monitor for suspicious activity related to template creation or deletion. Since no official fix is currently documented, applying principle of least privilege and limiting plugin dependencies may reduce risk.