CVE-2026-12435 is an authorization bypass vulnerability (CWE-862) in the Motors – Car Dealership & Classified Listings Plugin for WordPress. The plugin fails to properly verify user authorization when performing the 'stm_mark_as_sold_car' action. An authenticated attacker with subscriber-level permissions can replay a valid nonce harvested from their own listing against any other listing's post ID, causing the victim's listing to be marked as sold and its special_car featured post meta to be removed. This vulnerability affects all versions up to and including 1.4.111. No official patch or remediation guidance has been provided by the vendor at this time.

The vulnerability allows authenticated users with subscriber-level access to manipulate the status of other users' car listings by marking or unmarking them as sold without proper authorization. This results in integrity loss of listing data, potentially misleading site visitors and affecting the reputation of listings. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level users from adding listings if possible, monitor for suspicious activity related to listing status changes, and consider disabling or limiting the affected plugin functionality as a temporary measure.