CVE-2026-3892 is a high-severity vulnerability (CVSS 8.1) in the Motors – Car Dealership & Classified Listings Plugin for WordPress. It arises from CWE-73: External Control of File Name or Path. The plugin's profile update handler does not properly validate file paths when users upload a dealer logo, allowing authenticated users with subscriber or higher privileges to specify arbitrary filesystem paths. This flaw enables arbitrary file deletion on the server, impacting the integrity and availability of the system. The vulnerability affects all plugin versions up to 1.4.107. No patch or official remediation has been disclosed as of the published date.

An authenticated attacker with subscriber-level access or above can delete arbitrary files on the server hosting the vulnerable plugin. This can lead to denial of service or disruption of the website and potentially compromise system stability. The vulnerability does not directly impact confidentiality but has high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to trusted users only and monitor for suspicious activity related to file deletion. Avoid granting subscriber or higher access to untrusted users. Follow updates from the vendor for an official patch or mitigation instructions.