CVE-2025-3437 is a missing authorization vulnerability in the Motors – Car Dealership & Classified Listings Plugin for WordPress. The issue arises from the absence of capability checks on several functions within the ajax_actions.php file, affecting all plugin versions up to and including 1.4.66. This allows authenticated users with low privileges (Subscriber-level and above) to execute initial setup actions that should be restricted, potentially leading to unauthorized modification of plugin data or configuration.

The vulnerability enables authenticated users with minimal privileges to perform unauthorized modifications to the plugin's data or settings. While it does not allow direct data disclosure or denial of service, it can lead to integrity issues within the plugin's operation. The CVSS score of 4.3 reflects a medium impact primarily on data integrity without affecting confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unusual activity related to the plugin. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor for any forthcoming patches or official mitigations.