CVE-2025-10494 is an arbitrary file deletion vulnerability in the Motors – Car Dealership & Classified Listings Plugin for WordPress. It arises from insufficient validation of file paths during the deletion of profile pictures, allowing authenticated users with Subscriber-level privileges or higher to delete arbitrary files on the server. This can escalate to remote code execution if key files like wp-config.php are deleted. The vulnerability affects all plugin versions up to 1.4.89 and has a CVSS 3.1 score of 8.1, indicating high severity. No patch or official fix details are currently available.

An attacker with at least Subscriber-level access can delete arbitrary files on the server hosting the WordPress plugin. This can disrupt website functionality and potentially lead to remote code execution if critical files such as wp-config.php are deleted. The impact includes high integrity and availability damage, but no direct confidentiality impact is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user permissions to prevent Subscriber-level users from performing file deletions if possible. Monitor for plugin updates from the vendor and apply official patches promptly once available.