CVE-2026-1934 is a missing authorization vulnerability (CWE-862) in the Motors – Car Dealership & Classified Listings plugin for WordPress. The vulnerability arises because the stm_save_user_extra_fields() function updates sensitive user meta fields based on POST data without verifying that the current user has permission to modify those fields beyond checking if the user can edit their own profile. This allows authenticated users with Subscriber-level privileges or higher to set their stm_payment_status to 'completed', effectively bypassing PayPal payment verification and gaining unauthorized access to paid membership features. The issue affects all plugin versions up to 1.4.103. There is no vendor-provided patch or official remediation at this time.

Authenticated attackers with Subscriber-level access or higher can bypass payment verification by manipulating user meta fields, specifically setting their payment status to 'completed'. This grants unauthorized access to paid Dealer membership features without completing any transaction. The vulnerability does not impact confidentiality or availability but results in integrity loss of payment status data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions carefully and monitor for suspicious privilege escalations. Avoid granting Subscriber-level or higher access to untrusted users. Consider manual code review or temporary custom patches to enforce stricter authorization checks on user meta updates.